outsteel

General

Target
f58c41d83c0f1c1e8c1c3bd99ab6deabb14a763b54a3c5f1e821210c0536c3ff
Size 4.8MB
Sample240410-sa76esfb3v
SHA256 f58c41d83c0f1c1e8c1c3bd99ab6deabb14a763b54a3c5f1e821210c0536c3ff
MD5 259f06fcdb971f606d239b3178110981
SHA1 e2180bf4b9783d42d396826fc25ff8f9394cd430
SHA512 1c3bdadf325a498133788afba3fe1f8c684079345753ae4c09b4562bfb445a2cfbce132e133ca04cb689fbe9a883f681c1fcf28cfed785a63e51edc3fcf327dc
SSDEEP 49152:HwV7e4UdEmFoxt6LT/cZv17kbW6PaxjAzW0q0Myqi5jCeazHTL/HR85zA:HwVAzcZdYbW6yxUz40My5jCe0HP
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  f58c41d83c0f1c1e8c1c3bd99ab6deabb14a763b54a3c5f1e821210c0536c3ff
- Size 4.8MB
- SHA256 f58c41d83c0f1c1e8c1c3bd99ab6deabb14a763b54a3c5f1e821210c0536c3ff
- MD5 259f06fcdb971f606d239b3178110981
- SHA1 e2180bf4b9783d42d396826fc25ff8f9394cd430
- SHA512 1c3bdadf325a498133788afba3fe1f8c684079345753ae4c09b4562bfb445a2cfbce132e133ca04cb689fbe9a883f681c1fcf28cfed785a63e51edc3fcf327dc
- SSDEEP 49152:HwV7e4UdEmFoxt6LT/cZv17kbW6PaxjAzW0q0Myqi5jCeazHTL/HR85zA:HwVAzcZdYbW6yxUz40My5jCe0HP
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

outsteel saintbot zgrat discovery dropper persistence rat spyware stealer evasion trojan
- Detect ZGRat V2
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Modifies security service
  evasion
- OutSteel
  OutSteel is a file uploader and document stealer written in AutoIT.
  stealer outsteel
- SaintBot
  Saint Bot is a malware dropper being used to deliver secondary payloads such as information stealers.
  dropper saintbot
- SaintBot payload
- UAC bypass
  evasion trojan
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Registers COM server for autorun
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
behavioral1 behavioral2