Overview

overview

10

Static

static

10

NEW ORDER.exe

windows7-x64

10

NEW ORDER.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    f6a8b58d0d8447fa707d64edf96eb3c7eae9e3a6fc7fc882ea2f246493e9ec31
  • Size 2.9MB
  • Sample240318-cdyhdsdf86
  • SHA256 f6a8b58d0d8447fa707d64edf96eb3c7eae9e3a6fc7fc882ea2f246493e9ec31
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
purelogstealerzgratcollectionratstealer

Malware Config

Targets

    • Target
      NEW ORDER.pif
    • Size 2.9MB
    • SHA256 88670303d986c2ab42c91bf120273ceb7df2754708fc871820ca084e1678f670
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    purelogstealerzgratcollectionratstealer

    • Detect ZGRat V1

    • PureLog Stealer

      PureLog Stealer is an infostealer written in C#.

      stealerpurelogstealer

    • PureLog Stealer payload

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Loads dropped DLL

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks