General

  • Target

    ONECHEAT.exe

  • Size

    8.0MB

  • Sample

    240411-xvvs2sdf7x

  • MD5

    e8db6be4e6b4fa2e0e903a4eff8f620a

  • SHA1

    7fa63dc0b0560759658f9a2efab4659e917bd71b

  • SHA256

    37362d9d89030be684513e8d07f7b54893192a14818110ed1915021deefadb99

  • SHA512

    4114c1dc2979ab87624ea76f6b81704d86d3bae84dff4115d2663a3460068894d23c1cd8b4653086c7e71648e5723cba2cdd3ac53ab00a9ecbd2ba9823ca610e

  • SSDEEP

    196608:FjkXAfTw9kpnYknqwUSlDCRGfBCIWwB26CI5aR:FjxJpYqby6V9i

Malware Config

Targets

    • Target

      ONECHEAT.exe

    • Size

      8.0MB

    • MD5

      e8db6be4e6b4fa2e0e903a4eff8f620a

    • SHA1

      7fa63dc0b0560759658f9a2efab4659e917bd71b

    • SHA256

      37362d9d89030be684513e8d07f7b54893192a14818110ed1915021deefadb99

    • SHA512

      4114c1dc2979ab87624ea76f6b81704d86d3bae84dff4115d2663a3460068894d23c1cd8b4653086c7e71648e5723cba2cdd3ac53ab00a9ecbd2ba9823ca610e

    • SSDEEP

      196608:FjkXAfTw9kpnYknqwUSlDCRGfBCIWwB26CI5aR:FjxJpYqby6V9i

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Target

      ⌚/38.exe

    • Size

      4.7MB

    • MD5

      ca43f43bd60696a071914f7d56dfb170

    • SHA1

      0395c64a4cfc0c5b5e4f0213a2947e8971db0646

    • SHA256

      c589837b7c914750d50c96183a6133940d0770d0a690c81b7594dafad925b8a9

    • SHA512

      5a476ade3e31ecdd01544111912bdf3cc43883c32703b72d698420c1ee7ec839c01cb7eadc7bfdc2f94ea7b4caac2e2a4e3f3ee088f1a1674a242d4db8d4a3be

    • SSDEEP

      98304:ue5sDcJRr2LDOKwWDxVkZUm9i+lvBJ7fCwrra37elTmHzVczwqYrmhLyK:ue2I7r2LDbxVkZUmDlJFf/aZ7qN

    Score
    1/10
    • Target

      ⌚/ABC.exe

    • Size

      13KB

    • MD5

      2808310786effc87a4359c778a73a7ee

    • SHA1

      525f278678ad73a34c368f0afc4558ed0454f076

    • SHA256

      33d9753ee9b3920352b743d72adfd62c969ab0619eb5673151f478ebdfa197a5

    • SHA512

      02348e663f215ff6cf37cccea7ea4da3c53362aa75a1a0a88279b9a0acbf60deb30829b47ff7ce1ae97c43ca52b7e09ca90cbb621fee2da1a0ddcc65677c0d67

    • SSDEEP

      384:RWaw77Ke8FeO+DK32XzUzxcRx8ptYcFwVc03K:2KFqIUxItYcFwVc6K

    Score
    1/10
    • Target

      ⌚/mrn_protected.exe

    • Size

      3.6MB

    • MD5

      b14267d48b30dba8dcabd206a470aad7

    • SHA1

      b5f157257559d86f6fb94c2b13fee51309e1f860

    • SHA256

      2ac6ec590745348760ad8b486561e6a230d2fbba7444e2f6ad0c0ccc9355ce89

    • SHA512

      7f1ded2d19f7b33acfa2e8dcaff19c5bd5533e23e950d03cd973c3697012b4a04403f4bf35201f405a1f63ae8a455f0bc65dc4b556afc5afa26e7ff0595eaab3

    • SSDEEP

      98304:btBsTZjn6E/V4B9PNDTsJJEcKTXzy3RDWxmeuo6cBw:RyTZjnRdSDnoPKTXYRDj0w

    Score
    1/10

MITRE ATT&CK Enterprise v15

Tasks