Overview

overview

10

Static

static

3

2c2e13aa2a...00.exe

windows7-x64

10

2c2e13aa2a...00.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2c2e13aa2a4cd620cbdc6c7aff908100

  • Size

    1.1MB

  • Sample

    231231-hkk4jahfbl

  • MD5

    2c2e13aa2a4cd620cbdc6c7aff908100

  • SHA1

    4e837ccf0c4ba614989b96b95b002d516ddf4517

  • SHA256

    7555d64904a5d2c9cd8489c031afe9b095b1db27d2ac3664e23f25824018407e

  • SHA512

    36c26058ed94a7d737d1e53581355ddc67d9f698e88f315922e1d543593f7e7d6bf0ce126363cb8800d64c97e2fd72be33a38f0e8c3f32758635e9f60fada26a

  • SSDEEP

    24576:RDvlsb133PqjTWnxdAHPcp1YprUlMegz:lvuBnPqjTWkHUpk46e

Score
10/10
massloggerzgratratspywarestealer

Malware Config

Targets

    • Target

      2c2e13aa2a4cd620cbdc6c7aff908100

    • Size

      1.1MB

    • MD5

      2c2e13aa2a4cd620cbdc6c7aff908100

    • SHA1

      4e837ccf0c4ba614989b96b95b002d516ddf4517

    • SHA256

      7555d64904a5d2c9cd8489c031afe9b095b1db27d2ac3664e23f25824018407e

    • SHA512

      36c26058ed94a7d737d1e53581355ddc67d9f698e88f315922e1d543593f7e7d6bf0ce126363cb8800d64c97e2fd72be33a38f0e8c3f32758635e9f60fada26a

    • SSDEEP

      24576:RDvlsb133PqjTWnxdAHPcp1YprUlMegz:lvuBnPqjTWkHUpk46e

    Score
    10/10
    massloggerzgratratspywarestealer

    • Detect ZGRat V1

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

      stealerspywaremasslogger

    • MassLogger Main payload

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks