General

  • Target

    3f5e16b1b9fbf8fa880ee1b0bb351421f76b8162efbf480f0a639873b083eee1

  • Size

    430KB

  • Sample

    240403-p9k86add91

  • MD5

    37ae95b4ba72425c5341112ac123a284

  • SHA1

    1e9d6fd14c0d8cefaf63d37219e23d338574b0d4

  • SHA256

    3f5e16b1b9fbf8fa880ee1b0bb351421f76b8162efbf480f0a639873b083eee1

  • SHA512

    91ad8ddac1a178b2cb6df7849c2e1df3bd09201220d1ee397a03b17778d777e561402f22c98f3ef10a220d029321acf3e3946f4ee2fe7c57d92f13942951d4c3

  • SSDEEP

    6144:UTK1ILK/x9y4dpYsCgKIbf6hmGbsfBmIfMM0xrEWKJtBTGD2keV:UTbLK/zykYs/Ko8mLpbfMhrErRM2keV

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.209

Attributes
  • url_path

    /3cd2b41cbde8fc9c.php

Targets

    • Target

      3f5e16b1b9fbf8fa880ee1b0bb351421f76b8162efbf480f0a639873b083eee1

    • Size

      430KB

    • MD5

      37ae95b4ba72425c5341112ac123a284

    • SHA1

      1e9d6fd14c0d8cefaf63d37219e23d338574b0d4

    • SHA256

      3f5e16b1b9fbf8fa880ee1b0bb351421f76b8162efbf480f0a639873b083eee1

    • SHA512

      91ad8ddac1a178b2cb6df7849c2e1df3bd09201220d1ee397a03b17778d777e561402f22c98f3ef10a220d029321acf3e3946f4ee2fe7c57d92f13942951d4c3

    • SSDEEP

      6144:UTK1ILK/x9y4dpYsCgKIbf6hmGbsfBmIfMM0xrEWKJtBTGD2keV:UTbLK/zykYs/Ko8mLpbfMhrErRM2keV

    • Detect ZGRat V1

    • Stealc

      Stealc is an infostealer written in C++.

    • ZGRat

      ZGRat is remote access trojan written in C#.

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks