Overview

overview

10

Static

static

3

8ed90af568...fd.exe

windows7-x64

10

8ed90af568...fd.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8ed90af568cc5d8e5cb7e581d55795fd

  • Size

    1023KB

  • Sample

    240204-lwt3csghfn

  • MD5

    8ed90af568cc5d8e5cb7e581d55795fd

  • SHA1

    efd64d7374d4cda6df5670e9b1297767de24494d

  • SHA256

    b491a4000f6257ea0cb2abe7e322c50032e36ab24aa61ee109482e795ef0fd09

  • SHA512

    c7f7e1ff4f5d5151e5f6c2e23b11647717b57737707dfb2ba3269405a9ba6317c4b9e3f61e94df6e51495db0553b176b3f735194c042c84a6cf8356ba345bff6

  • SSDEEP

    24576:fdya7rWvVw9ZgfHypAMmgGInjZ5YcL/GazTOV:f3rW/gVyyuazTO

Score
10/10
hawkeyezgratcollectionkeyloggerpersistenceratspywarestealertrojan

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    ayocj2018

Targets

    • Target

      8ed90af568cc5d8e5cb7e581d55795fd

    • Size

      1023KB

    • MD5

      8ed90af568cc5d8e5cb7e581d55795fd

    • SHA1

      efd64d7374d4cda6df5670e9b1297767de24494d

    • SHA256

      b491a4000f6257ea0cb2abe7e322c50032e36ab24aa61ee109482e795ef0fd09

    • SHA512

      c7f7e1ff4f5d5151e5f6c2e23b11647717b57737707dfb2ba3269405a9ba6317c4b9e3f61e94df6e51495db0553b176b3f735194c042c84a6cf8356ba345bff6

    • SSDEEP

      24576:fdya7rWvVw9ZgfHypAMmgGInjZ5YcL/GazTOV:f3rW/gVyyuazTO

    Score
    10/10
    hawkeyezgratcollectionkeyloggerpersistenceratspywarestealertrojan

    • Detect ZGRat V1

    • HawkEye

      HawkEye is a malware kit that has seen continuous development since at least 2013.

      keyloggertrojanstealerspywarehawkeye

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook accounts

      collection

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks