General
-
Target
a600e62175d692833fe231cc31d13a2794b9bf035c5b32bd72ee9987738ea048
-
Size
505KB
-
Sample
240407-2pqz5aha25
-
MD5
5df824cb305056997bc23fc2be6899ca
-
SHA1
54602693a96031b8438d56d51e86edf6eacac876
-
SHA256
a600e62175d692833fe231cc31d13a2794b9bf035c5b32bd72ee9987738ea048
-
SHA512
03029fe40379b664f4c6cf00bf0bd973d228057f068efe82bc35fae0fe7a15d6b079c0d8925d71250fdbb0021886891970ad6900d855a5c790afe3f04da507c3
-
SSDEEP
6144:jre8uT58rY642SGXvDAgRGe9xEbdHAXnzAMubnYlxhNWG/wRiTIeVf+Utz4:jqx58rYSdke+mnz5sCNT/vXVfnh4
Static task
static1
Behavioral task
behavioral1
Sample
a600e62175d692833fe231cc31d13a2794b9bf035c5b32bd72ee9987738ea048.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
stealc
http://185.172.128.209
-
url_path
/3cd2b41cbde8fc9c.php
Targets
-
-
Target
a600e62175d692833fe231cc31d13a2794b9bf035c5b32bd72ee9987738ea048
-
Size
505KB
-
MD5
5df824cb305056997bc23fc2be6899ca
-
SHA1
54602693a96031b8438d56d51e86edf6eacac876
-
SHA256
a600e62175d692833fe231cc31d13a2794b9bf035c5b32bd72ee9987738ea048
-
SHA512
03029fe40379b664f4c6cf00bf0bd973d228057f068efe82bc35fae0fe7a15d6b079c0d8925d71250fdbb0021886891970ad6900d855a5c790afe3f04da507c3
-
SSDEEP
6144:jre8uT58rY642SGXvDAgRGe9xEbdHAXnzAMubnYlxhNWG/wRiTIeVf+Utz4:jqx58rYSdke+mnz5sCNT/vXVfnh4
-
Detect ZGRat V1
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-