Overview

overview

10

Static

static

3

f1ec304e5b...18.exe

windows7-x64

10

f1ec304e5b...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f1ec304e5be150aca87f071e47a5d025_JaffaCakes118

  • Size

    683KB

  • Sample

    240415-zw13kagd35

  • MD5

    f1ec304e5be150aca87f071e47a5d025

  • SHA1

    6c981d077f980958f4d5a405928eee3385545778

  • SHA256

    78a20f7c54434dd382b55ca3256778ef987ba1035d5e91c9d0d25c9d801f8add

  • SHA512

    adba0407db594918a044ab2d148975b1e4bfcf74a22f1a5b5f7a149eb491d8dc1d278593198f9898327fcf6da37b93f387b0544629a1fc2a1e330e49828ad229

  • SSDEEP

    12288:CTU+bmzUri3pwCCtfE95OJmufAW5Gn5vX4LEjYj9qfU9nAZz0fI+KvnVbnc8/FMm:C9mzp3cfFJmun4nt5kASAJ0fFKvnpnrT

Score
10/10
blustealerzgratpersistenceratstealer

Malware Config

Extracted

Family

blustealer

Credentials

  • Protocol:     smtp
  • Host:
    budgetn.xyz
  • Port:
    587
  • Username:
    shunyuan@budgetn.xyz
  • Password:
    r[]w2e=V+]AV

Targets

    • Target

      f1ec304e5be150aca87f071e47a5d025_JaffaCakes118

    • Size

      683KB

    • MD5

      f1ec304e5be150aca87f071e47a5d025

    • SHA1

      6c981d077f980958f4d5a405928eee3385545778

    • SHA256

      78a20f7c54434dd382b55ca3256778ef987ba1035d5e91c9d0d25c9d801f8add

    • SHA512

      adba0407db594918a044ab2d148975b1e4bfcf74a22f1a5b5f7a149eb491d8dc1d278593198f9898327fcf6da37b93f387b0544629a1fc2a1e330e49828ad229

    • SSDEEP

      12288:CTU+bmzUri3pwCCtfE95OJmufAW5Gn5vX4LEjYj9qfU9nAZz0fI+KvnVbnc8/FMm:C9mzp3cfFJmun4nt5kASAJ0fFKvnpnrT

    Score
    10/10
    blustealerzgratpersistenceratstealer

    • BluStealer

      A Modular information stealer written in Visual Basic.

      stealerblustealer

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks