General

  • Target

    8d9f58c1f4a048e38f6840780248429a1f7961dd0fd885b1973d0b3c4e07ad35

  • Size

    431KB

  • Sample

    240403-wbyj6age52

  • MD5

    1a12f1717f4bde465c233da5e4f1d2a6

  • SHA1

    892ddaab44737774ae495c418e32a6d032447857

  • SHA256

    8d9f58c1f4a048e38f6840780248429a1f7961dd0fd885b1973d0b3c4e07ad35

  • SHA512

    4fa9c8b902b4e974ceebd4fc24e677e03a7a48fd72875b9aafb4e16504bbc137f1886aa02ada4e5fecae0b83bdd36f4b01edc5f7b45e77daad264053a472a360

  • SSDEEP

    6144:x0VR/4Ys2QCqS2d5Des21BdwFyATs2gWzuoPvpHG48QOYra3x1BTMwcr:xMiYs2JqS2tFIkvw48QO6a3hMwcr

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.209

Attributes
  • url_path

    /3cd2b41cbde8fc9c.php

Targets

    • Target

      8d9f58c1f4a048e38f6840780248429a1f7961dd0fd885b1973d0b3c4e07ad35

    • Size

      431KB

    • MD5

      1a12f1717f4bde465c233da5e4f1d2a6

    • SHA1

      892ddaab44737774ae495c418e32a6d032447857

    • SHA256

      8d9f58c1f4a048e38f6840780248429a1f7961dd0fd885b1973d0b3c4e07ad35

    • SHA512

      4fa9c8b902b4e974ceebd4fc24e677e03a7a48fd72875b9aafb4e16504bbc137f1886aa02ada4e5fecae0b83bdd36f4b01edc5f7b45e77daad264053a472a360

    • SSDEEP

      6144:x0VR/4Ys2QCqS2d5Des21BdwFyATs2gWzuoPvpHG48QOYra3x1BTMwcr:xMiYs2JqS2tFIkvw48QO6a3hMwcr

    • Detect ZGRat V1

    • Stealc

      Stealc is an infostealer written in C++.

    • ZGRat

      ZGRat is remote access trojan written in C#.

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks