Overview

overview

10

Static

static

10

5b49aff6fd...33.exe

windows7-x64

10

5b49aff6fd...33.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    5b49aff6fd63d3b47a42af95b2ab6233

  • Size

    718KB

  • Sample

    240127-f1almafebl

  • MD5

    5b49aff6fd63d3b47a42af95b2ab6233

  • SHA1

    7c8eb1f7cc5f7e4fa9bec036261ccdb04be3e34b

  • SHA256

    8f77873bce69f4dfa664af8aa6204f9b5a54bbedbb00665fc60e29791d4f3539

  • SHA512

    b388ae83fc7745c14d32f060dbf519a170592d986ca599f6b84719419e0c8209eebad89546702fd586ce4b75ea0318241ccb51fe4b3578c3924caf4d7f95ec33

  • SSDEEP

    12288:s3QCUOkr6NDTpQ+pRyc/djugCbkNA7DKTO68jSgBCR0kFMh:jfwQQRHFjkINAEJ8WgBOFMh

Score
10/10
redlinezgratdiscoveryinfostealerratspywarestealer

Malware Config

Targets

    • Target

      5b49aff6fd63d3b47a42af95b2ab6233

    • Size

      718KB

    • MD5

      5b49aff6fd63d3b47a42af95b2ab6233

    • SHA1

      7c8eb1f7cc5f7e4fa9bec036261ccdb04be3e34b

    • SHA256

      8f77873bce69f4dfa664af8aa6204f9b5a54bbedbb00665fc60e29791d4f3539

    • SHA512

      b388ae83fc7745c14d32f060dbf519a170592d986ca599f6b84719419e0c8209eebad89546702fd586ce4b75ea0318241ccb51fe4b3578c3924caf4d7f95ec33

    • SSDEEP

      12288:s3QCUOkr6NDTpQ+pRyc/djugCbkNA7DKTO68jSgBCR0kFMh:jfwQQRHFjkINAEJ8WgBOFMh

    Score
    10/10
    redlinezgratdiscoveryinfostealerratspywarestealer

    • Detect ZGRat V1

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks