General
-
Target
3f5e16b1b9fbf8fa880ee1b0bb351421f76b8162efbf480f0a639873b083eee1
-
Size
430KB
-
Sample
240403-p9k86add91
-
MD5
37ae95b4ba72425c5341112ac123a284
-
SHA1
1e9d6fd14c0d8cefaf63d37219e23d338574b0d4
-
SHA256
3f5e16b1b9fbf8fa880ee1b0bb351421f76b8162efbf480f0a639873b083eee1
-
SHA512
91ad8ddac1a178b2cb6df7849c2e1df3bd09201220d1ee397a03b17778d777e561402f22c98f3ef10a220d029321acf3e3946f4ee2fe7c57d92f13942951d4c3
-
SSDEEP
6144:UTK1ILK/x9y4dpYsCgKIbf6hmGbsfBmIfMM0xrEWKJtBTGD2keV:UTbLK/zykYs/Ko8mLpbfMhrErRM2keV
Static task
static1
Behavioral task
behavioral1
Sample
3f5e16b1b9fbf8fa880ee1b0bb351421f76b8162efbf480f0a639873b083eee1.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
stealc
http://185.172.128.209
-
url_path
/3cd2b41cbde8fc9c.php
Targets
-
-
Target
3f5e16b1b9fbf8fa880ee1b0bb351421f76b8162efbf480f0a639873b083eee1
-
Size
430KB
-
MD5
37ae95b4ba72425c5341112ac123a284
-
SHA1
1e9d6fd14c0d8cefaf63d37219e23d338574b0d4
-
SHA256
3f5e16b1b9fbf8fa880ee1b0bb351421f76b8162efbf480f0a639873b083eee1
-
SHA512
91ad8ddac1a178b2cb6df7849c2e1df3bd09201220d1ee397a03b17778d777e561402f22c98f3ef10a220d029321acf3e3946f4ee2fe7c57d92f13942951d4c3
-
SSDEEP
6144:UTK1ILK/x9y4dpYsCgKIbf6hmGbsfBmIfMM0xrEWKJtBTGD2keV:UTbLK/zykYs/Ko8mLpbfMhrErRM2keV
-
Detect ZGRat V1
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-