General

  • Target

    c28fec56c0556cc3856f3926e7fc2418c332117ae076f1f95483b42e17af4554

  • Size

    6.6MB

  • Sample

    231224-2pkhcaghe6

  • MD5

    4b7a7ed0493e117ed0e1ae8909f7c8ec

  • SHA1

    5abf96d871eba85201d8979a6d54b7046bcf04be

  • SHA256

    c28fec56c0556cc3856f3926e7fc2418c332117ae076f1f95483b42e17af4554

  • SHA512

    b2ac95a17bf8ce36469452443cb0c54f3481c4b48562287ccac2373a7e7607046d05082891a11045c9ef338eac007fd19b10f3e3d2cd2cccd582f506c7c984ad

  • SSDEEP

    98304:JtuglcPbKRUpHksoNfPrE4LFfVWv4u5PVsOv2THPHg3:eglcPbKRUpHksWJijhVD0E

Malware Config

Targets

    • Target

      c28fec56c0556cc3856f3926e7fc2418c332117ae076f1f95483b42e17af4554

    • Size

      6.6MB

    • MD5

      4b7a7ed0493e117ed0e1ae8909f7c8ec

    • SHA1

      5abf96d871eba85201d8979a6d54b7046bcf04be

    • SHA256

      c28fec56c0556cc3856f3926e7fc2418c332117ae076f1f95483b42e17af4554

    • SHA512

      b2ac95a17bf8ce36469452443cb0c54f3481c4b48562287ccac2373a7e7607046d05082891a11045c9ef338eac007fd19b10f3e3d2cd2cccd582f506c7c984ad

    • SSDEEP

      98304:JtuglcPbKRUpHksoNfPrE4LFfVWv4u5PVsOv2THPHg3:eglcPbKRUpHksWJijhVD0E

    • Detect ZGRat V1

    • Detects Arechclient2 RAT

      Arechclient2.

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • ZGRat

      ZGRat is remote access trojan written in C#.

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks