Overview

overview

10

Static

static

10

driver1.exe

windows11-21h2-x64

10

Resubmissions

27/01/2024, 14:29

240127-rtsdmsfggl 10

27/01/2024, 14:26

240127-rr6hgsfgdr 10

Sharing

Copy URL Twitter E-mail

General

  • Target

    driver1.exe

  • Size

    513KB

  • Sample

    240127-rr6hgsfgdr

  • MD5

    ecd563c8ea2125310eada2daac93251a

  • SHA1

    1d8e53b0d094b51f5db03d8bdffbeafde33ddaf0

  • SHA256

    77fbf732a2e1869f995d5d5d38a1ac0b35edba9a83ed557d8abb45dec9bbd604

  • SHA512

    be722be655e3ec4aef28651f9fe21cfa48af3abe2aa2c8158e991d75115bcaf8ceebf31737c54cae565c86fa275c252bf68dae5cb2e257c232cea7e61277bece

  • SSDEEP

    6144:Vy55yyymLLkkGGt/+9bBfgcqVXCtKPIszeQYsqRCbIW/Ib4YzCm/Db+3Hsj0OrPJ:VL2yttQYsqREcYmL63MoWyw/539HDn

Score
10/10
redlinezgratdiscoveryinfostealerratspywarestealer

Malware Config

Targets

    • Target

      driver1.exe

    • Size

      513KB

    • MD5

      ecd563c8ea2125310eada2daac93251a

    • SHA1

      1d8e53b0d094b51f5db03d8bdffbeafde33ddaf0

    • SHA256

      77fbf732a2e1869f995d5d5d38a1ac0b35edba9a83ed557d8abb45dec9bbd604

    • SHA512

      be722be655e3ec4aef28651f9fe21cfa48af3abe2aa2c8158e991d75115bcaf8ceebf31737c54cae565c86fa275c252bf68dae5cb2e257c232cea7e61277bece

    • SSDEEP

      6144:Vy55yyymLLkkGGt/+9bBfgcqVXCtKPIszeQYsqRCbIW/Ib4YzCm/Db+3Hsj0OrPJ:VL2yttQYsqREcYmL63MoWyw/539HDn

    Score
    10/10
    redlinezgratdiscoveryinfostealerratspywarestealer

    • Detect ZGRat V1

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Drops startup file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks