Overview

overview

10

Static

static

1

AxoPac.rar

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    AxoPac.rar

  • Size

    20.6MB

  • Sample

    240420-dkmj5sff4x

  • MD5

    e6f671197bc5eca6ee28e5ac29dc6615

  • SHA1

    54bc05ce0f7ab9da102505022e551da5d8856a90

  • SHA256

    274d9287308cb40c4facfe81679a80783a061efb7772b4a8c3b7eb05dc0e419b

  • SHA512

    774492d112915607d92e30f6fa6fc62e0a40d5b6dacbbb0f8ec9b992f85e5f2bb25f5c7564fd494206d3d9e03984446c4e40715b9bdb7dd39357f67deaf303a9

  • SSDEEP

    393216:/LVcOR/Pp72TAHwPMCEtu+o517JXRbIu9JpJKxDRsn2bZ/exuW9:RcOR/xyMQ4tu++5Rn9+9s2bw7

Score
10/10
redlinezgratdiscoveryinfostealerpersistenceratspywarestealer

Malware Config

Targets

    • Target

      AxoPac.rar

    • Size

      20.6MB

    • MD5

      e6f671197bc5eca6ee28e5ac29dc6615

    • SHA1

      54bc05ce0f7ab9da102505022e551da5d8856a90

    • SHA256

      274d9287308cb40c4facfe81679a80783a061efb7772b4a8c3b7eb05dc0e419b

    • SHA512

      774492d112915607d92e30f6fa6fc62e0a40d5b6dacbbb0f8ec9b992f85e5f2bb25f5c7564fd494206d3d9e03984446c4e40715b9bdb7dd39357f67deaf303a9

    • SSDEEP

      393216:/LVcOR/Pp72TAHwPMCEtu+o517JXRbIu9JpJKxDRsn2bZ/exuW9:RcOR/xyMQ4tu++5Rn9+9s2bw7

    Score
    10/10
    redlinezgratdiscoveryinfostealerpersistenceratspywarestealer

    • Detect ZGRat V1

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Registers COM server for autorun

      persistence

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Query Registry

4
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks