General

  • Target

    gta_betabuild 1.31.zip

  • Size

    25KB

  • Sample

    240325-tzq4waff8w

  • MD5

    427eb31d04d99c162815fbc70a8ddd31

  • SHA1

    d8a5aeea0c1e5b37390a46df9cee0143fdbf555a

  • SHA256

    0ee5edc4732d5d52527637044a9095878e2bffebe6f39995405ce6165e5a66d9

  • SHA512

    45f87ef1f33376905f925c87de93e977dfd1467b349fa5a42b74a3bda571db51d1863301613323b7b445e88465b9a00a8a8e2cbd00f3fdf46d3389e78100d93c

  • SSDEEP

    768:dxOfk1ZsqbiWkLRP/Dy0kOswpxOe5+ziNpNFl2o8:dxOfkQqbc/W0awtQYpNFl2L

Malware Config

Extracted

Family

xenorat

C2

37.120.141.155

Mutex

modtool_gta

Attributes
  • delay

    5000

  • install_path

    appdata

  • port

    22914

  • startup_name

    WinSCVUpdater

Targets

    • Target

      gta_betabuild 1.31.exe

    • Size

      117KB

    • MD5

      0d8a7a20410bfea30a7d32fa86be00fa

    • SHA1

      10f3067f1e716cc78fcf4b66eb03f853d81276ad

    • SHA256

      d1df4ce9ca2c33cc2afbf8816788c1cbfd58e352a18ce9f76242b7aa53a109dd

    • SHA512

      b1d0ed93247eb03b7fc3b29002b51ae3d966fc186b8d9007d16c78ec7e3eb69087b8b273785947def6ba013eac5d93b13f5244a25b5d4150cdd07b8ad74c9092

    • SSDEEP

      768:ESivdjHrddilbVauou79EoJWqnIBXBxmHjBSkGu2yPo+LGZYebFDat26RNSgNORM:ErpHmVauo3tTxkDj6CSYebFoTf4K

    • XenorRat

      XenorRat is a remote access trojan written in C#.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

MITRE ATT&CK Enterprise v15

Tasks