Overview

overview

10

Static

static

10

53d5c2574c...fa.exe

windows7-x64

10

53d5c2574c...fa.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    53d5c2574c7f70b7aa69243916acf6e43fe4258fbd015660032784e150b3b4fa.zip

  • Size

    1.2MB

  • Sample

    240101-res2macbep

  • MD5

    533fbf58626e2b6072d654fc2b827d2e

  • SHA1

    166338a870a0dfcc14dc58a4a49d287c7651566e

  • SHA256

    2fd750752bd4353630fb36208fbe420cd05bd47d93ee7b52bb987d35bc41f269

  • SHA512

    d410744d88ddede4224d3f4d3af92923000edd88bf5be2719a838c3c2cdd696f1ea59794647dc9930857336204ad85ea4143eb73612a2ad517db6e8843183b19

  • SSDEEP

    24576:juQ7lUE6TMD55qJgLz7rX5IOesFj8BpdyH2d+4iaSQs2WIS/46mXESs3jlxs:qEOIz7rusV8QWIxazAH/kESs3jlxs

Score
10/10
echelonzgratcollectiondiscoveryratspywarestealer

Malware Config

Targets

    • Target

      53d5c2574c7f70b7aa69243916acf6e43fe4258fbd015660032784e150b3b4fa

    • Size

      1.4MB

    • MD5

      0d61d50067eb93ae9ce049be387ae4e2

    • SHA1

      8fff0a09cb0cfd332d38d421d2debfc4408686c5

    • SHA256

      53d5c2574c7f70b7aa69243916acf6e43fe4258fbd015660032784e150b3b4fa

    • SHA512

      d0bfadfc2d002c8ce274d5e5143e1c9a2b9ed6df1c3188607a2dd408c375bf31af58a7a0b2b9793dbbbd99d44843f00465947237e95f9ab22cf49a0847f86a22

    • SSDEEP

      24576:a7KmUvqfA6xLd/G9QfCRnGRAm/TaHAl/Y9+vbzC0heKaSGXAsLkv:WK7qfw9Q6QHaHAl/Y9wbuRKLkLQ

    Score
    10/10
    echelonzgratcollectiondiscoveryratspywarestealer

    • Detect ZGRat V2

    • Echelon

      Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.

      stealerspywareechelon

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Accesses Microsoft Outlook profiles

      collection

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops desktop.ini file(s)

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks