General

  • Target

    d3632a106d33554e6f1b4865c072efb061f8b5efde72acf22efa6b92e3e871bf

  • Size

    407KB

  • Sample

    240424-yh9xwagd22

  • MD5

    2427abb2118e50c493ac5bbaf95e6b69

  • SHA1

    f83503943fea4c7cf4ee455b6e18a96db02d8a16

  • SHA256

    d3632a106d33554e6f1b4865c072efb061f8b5efde72acf22efa6b92e3e871bf

  • SHA512

    d799bda8205d7f78011279f948976334b05b868d56bfab442e6d2680ddd53038f2e26ac5cb5efbeeac6e1828c892629e383d6cac1f9126ba0d66ad501cdfa77c

  • SSDEEP

    12288:TR9O+taKgZxoUe8NtddpJ3UMpZIedELuRo:++0Px/TUaZIyELuRo

Malware Config

Targets

    • Target

      d3632a106d33554e6f1b4865c072efb061f8b5efde72acf22efa6b92e3e871bf

    • Size

      407KB

    • MD5

      2427abb2118e50c493ac5bbaf95e6b69

    • SHA1

      f83503943fea4c7cf4ee455b6e18a96db02d8a16

    • SHA256

      d3632a106d33554e6f1b4865c072efb061f8b5efde72acf22efa6b92e3e871bf

    • SHA512

      d799bda8205d7f78011279f948976334b05b868d56bfab442e6d2680ddd53038f2e26ac5cb5efbeeac6e1828c892629e383d6cac1f9126ba0d66ad501cdfa77c

    • SSDEEP

      12288:TR9O+taKgZxoUe8NtddpJ3UMpZIedELuRo:++0Px/TUaZIyELuRo

    • Detect ZGRat V1

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Stealc

      Stealc is an infostealer written in C++.

    • ZGRat

      ZGRat is remote access trojan written in C#.

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks