Overview

overview

10

Static

static

3

SecuriteIn...65.exe

windows7-x64

10

SecuriteIn...65.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SecuriteInfo.com.Win32.PWSX-gen.21665.13004

  • Size

    583KB

  • Sample

    231211-f293waebgp

  • MD5

    78019d76135bfb355994f73b5e79f723

  • SHA1

    1a257754f4c9e2c375f53b2d6aa71e8414e21d47

  • SHA256

    0dbc86c5875d5ffa658b1a9a0d2011bbda706ab0c1909a905824046321251027

  • SHA512

    6cbb49beae0b8e63b1ab4e930118eeb357ef905fe66f05d29fc699b55f3ed1debb40c7f023a20a47072d87d6526d60f2b78772cd1338ab6df201fa888008ec43

  • SSDEEP

    12288:/3IU8S6eUdqUu7HnYzNncfTdR8ogr22jX6rg5:PItSAd/u7YlcfHFgrYU5

Score
10/10
snakekeyloggerzgratcollectionkeyloggerratstealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Targets

    • Target

      SecuriteInfo.com.Win32.PWSX-gen.21665.13004

    • Size

      583KB

    • MD5

      78019d76135bfb355994f73b5e79f723

    • SHA1

      1a257754f4c9e2c375f53b2d6aa71e8414e21d47

    • SHA256

      0dbc86c5875d5ffa658b1a9a0d2011bbda706ab0c1909a905824046321251027

    • SHA512

      6cbb49beae0b8e63b1ab4e930118eeb357ef905fe66f05d29fc699b55f3ed1debb40c7f023a20a47072d87d6526d60f2b78772cd1338ab6df201fa888008ec43

    • SSDEEP

      12288:/3IU8S6eUdqUu7HnYzNncfTdR8ogr22jX6rg5:PItSAd/u7YlcfHFgrYU5

    Score
    10/10
    snakekeyloggerzgratkeyloggerratstealercollection

    • Detect ZGRat V1

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks