Overview

overview

10

Static

static

3

SecuriteIn...83.exe

windows7-x64

10

SecuriteIn...83.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SecuriteInfo.com.Win32.PWSX-gen.29210.19083.exe

  • Size

    555KB

  • Sample

    231212-nevzfacacn

  • MD5

    e8a284395efbc80745f8610494df4b18

  • SHA1

    98ae45686c0e220320d76a6d53f15c616a4c5af4

  • SHA256

    9c3c75f3073c8a3aa8557fb4f1797ff3dded28fead9787620919526efb2fb060

  • SHA512

    89023473dd712f49f23d3e345c9f0c86108b13a40d4e29f20c10aec710ebdabe78818b7df7a06f434ff7cf255e6db9580c17b1ed3a566d4e4e41bb247c9fc963

  • SSDEEP

    12288:lykTxOO+4WpAEuy7Q9oWupl0dj8I2DS1XWKNIOBjJILJBHEpsfYWsK3UiV6/+:+pAETll0dmbCbs07WDT6

Score
10/10
snakekeyloggerzgratcollectionkeyloggerratstealer

Malware Config

Targets

    • Target

      SecuriteInfo.com.Win32.PWSX-gen.29210.19083.exe

    • Size

      555KB

    • MD5

      e8a284395efbc80745f8610494df4b18

    • SHA1

      98ae45686c0e220320d76a6d53f15c616a4c5af4

    • SHA256

      9c3c75f3073c8a3aa8557fb4f1797ff3dded28fead9787620919526efb2fb060

    • SHA512

      89023473dd712f49f23d3e345c9f0c86108b13a40d4e29f20c10aec710ebdabe78818b7df7a06f434ff7cf255e6db9580c17b1ed3a566d4e4e41bb247c9fc963

    • SSDEEP

      12288:lykTxOO+4WpAEuy7Q9oWupl0dj8I2DS1XWKNIOBjJILJBHEpsfYWsK3UiV6/+:+pAETll0dmbCbs07WDT6

    Score
    10/10
    snakekeyloggerzgratkeyloggerratstealercollection

    • Detect ZGRat V1

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks