Overview

overview

10

Static

static

1

ffad5217eb...28.exe

windows7-x64

10

ffad5217eb...28.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ffad5217eb782aced4ab2c746b49891b496e1b90331ca24186f8349a5fa71a28

  • Size

    938KB

  • Sample

    240410-sjwhzscd86

  • MD5

    d7510192dd826e6c63266ba412c4a8c6

  • SHA1

    e51431ab4448d503db3d154d1da7bec25eb5aaac

  • SHA256

    ffad5217eb782aced4ab2c746b49891b496e1b90331ca24186f8349a5fa71a28

  • SHA512

    d73107b3f061d95a10f3e2ae025bfccad587866d4ccca8a71b31d51f34119d5127ed313a96ef3fe3421939ae871575d5e7ff7fd28eb9b2ddb3eef7f29c528ebc

  • SSDEEP

    12288:xtkuv9tmvboNKAM9qPg6f0blJwoodEJLaCyi5yH6CxBX5evFmwEH07i2Yvf+vMM4:xtkuv9mENKAiGolJwooKJVyVBpeERjM4

Score
10/10
outsteelzgratratspywarestealer

Malware Config

Targets

    • Target

      ffad5217eb782aced4ab2c746b49891b496e1b90331ca24186f8349a5fa71a28

    • Size

      938KB

    • MD5

      d7510192dd826e6c63266ba412c4a8c6

    • SHA1

      e51431ab4448d503db3d154d1da7bec25eb5aaac

    • SHA256

      ffad5217eb782aced4ab2c746b49891b496e1b90331ca24186f8349a5fa71a28

    • SHA512

      d73107b3f061d95a10f3e2ae025bfccad587866d4ccca8a71b31d51f34119d5127ed313a96ef3fe3421939ae871575d5e7ff7fd28eb9b2ddb3eef7f29c528ebc

    • SSDEEP

      12288:xtkuv9tmvboNKAM9qPg6f0blJwoodEJLaCyi5yH6CxBX5evFmwEH07i2Yvf+vMM4:xtkuv9mENKAiGolJwooKJVyVBpeERjM4

    Score
    10/10
    outsteelzgratratspywarestealer

    • Detect ZGRat V2

    • OutSteel

      OutSteel is a file uploader and document stealer written in AutoIT.

      stealeroutsteel

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks