General

  • Target

    ZAZAgenv2.exe (1) (1).exe

  • Size

    3.8MB

  • Sample

    230202-th6g8sff77

  • MD5

    5adc42fc3c4641933072fd628c07778b

  • SHA1

    88dacdf1ab3aea812c7aaeb0e532edddf22c1ef4

  • SHA256

    0db34a2edc14731f5a5b0a0cd0ce855f76a43f0279d0259383682ee59eba43f2

  • SHA512

    9fcfda10612301d90846042b8a8ee5519012727caf5c4138037934b6ccd12cd9808c2e1c8378e54cc72b7a26fbc1274224179bb36e17f937b2254ba4b4dc7678

  • SSDEEP

    98304:Qu0T+Srp3YVrsk9N8ivyhAdsPSQxhsnWJLXq0f9ogdCyb:QtfSVN8iNISOlJzqwf

Malware Config

Targets

    • Target

      ZAZAgenv2.exe (1) (1).exe

    • Size

      3.8MB

    • MD5

      5adc42fc3c4641933072fd628c07778b

    • SHA1

      88dacdf1ab3aea812c7aaeb0e532edddf22c1ef4

    • SHA256

      0db34a2edc14731f5a5b0a0cd0ce855f76a43f0279d0259383682ee59eba43f2

    • SHA512

      9fcfda10612301d90846042b8a8ee5519012727caf5c4138037934b6ccd12cd9808c2e1c8378e54cc72b7a26fbc1274224179bb36e17f937b2254ba4b4dc7678

    • SSDEEP

      98304:Qu0T+Srp3YVrsk9N8ivyhAdsPSQxhsnWJLXq0f9ogdCyb:QtfSVN8iNISOlJzqwf

    • StormKitty

      StormKitty is an open source info stealer written in C#.

    • StormKitty payload

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

1
T1005

Tasks