outsteel

General

Target

f58c41d83c0f1c1e8c1c3bd99ab6deabb14a763b54a3c5f1e821210c0536c3ff
Size

4.8MB
Sample

240410-sa76esfb3v
MD5

259f06fcdb971f606d239b3178110981
SHA1

e2180bf4b9783d42d396826fc25ff8f9394cd430
SHA256

f58c41d83c0f1c1e8c1c3bd99ab6deabb14a763b54a3c5f1e821210c0536c3ff
SHA512

1c3bdadf325a498133788afba3fe1f8c684079345753ae4c09b4562bfb445a2cfbce132e133ca04cb689fbe9a883f681c1fcf28cfed785a63e51edc3fcf327dc
SSDEEP

49152:HwV7e4UdEmFoxt6LT/cZv17kbW6PaxjAzW0q0Myqi5jCeazHTL/HR85zA:HwVAzcZdYbW6yxUz40My5jCe0HP

Score

10^/10

Malware Config

Targets

- Target
  
  f58c41d83c0f1c1e8c1c3bd99ab6deabb14a763b54a3c5f1e821210c0536c3ff
- Size
  
  4.8MB
- MD5
  
  259f06fcdb971f606d239b3178110981
- SHA1
  
  e2180bf4b9783d42d396826fc25ff8f9394cd430
- SHA256
  
  f58c41d83c0f1c1e8c1c3bd99ab6deabb14a763b54a3c5f1e821210c0536c3ff
- SHA512
  
  1c3bdadf325a498133788afba3fe1f8c684079345753ae4c09b4562bfb445a2cfbce132e133ca04cb689fbe9a883f681c1fcf28cfed785a63e51edc3fcf327dc
- SSDEEP
  
  49152:HwV7e4UdEmFoxt6LT/cZv17kbW6PaxjAzW0q0Myqi5jCeazHTL/HR85zA:HwVAzcZdYbW6yxUz40My5jCe0HP
Score

10^/10

outsteel saintbot zgrat discovery dropper persistence rat spyware stealer evasion trojan
- Detect ZGRat V2
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Modifies security service
  evasion
- OutSteel
  OutSteel is a file uploader and document stealer written in AutoIT.
  stealer outsteel
- SaintBot
  Saint Bot is a malware dropper being used to deliver secondary payloads such as information stealers.
  dropper saintbot
- SaintBot payload
- UAC bypass
  evasion trojan
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Registers COM server for autorun
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
behavioral1 behavioral2