General

  • Target

    480b540cb344d74306d03347658b2018a4b8504f4055ad15ba43456953d7b33c.exe

  • Size

    416KB

  • Sample

    240426-bjz3qsgf8v

  • MD5

    41de8e3e7412b6e97b60fdbfdd24b0ba

  • SHA1

    fa48e5a86b5f2b04b79f6c3459339a16c2db6aaa

  • SHA256

    480b540cb344d74306d03347658b2018a4b8504f4055ad15ba43456953d7b33c

  • SHA512

    d25d39fcbbc59677f4090ac5422c121d45c2085bfdb16adb7f8854a365636ac7baf42f74ccb435e11b1c355c83c28d80bfb58d8495e0d5ab2f59f3987390a1d5

  • SSDEEP

    12288:BFc5MyBQNGCCIYu7GJ9QICQfEHVmJspao:BOdWNYIx7W90uEao

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.76

Attributes
  • url_path

    /3cd2b41cbde8fc9c.php

Targets

    • Target

      480b540cb344d74306d03347658b2018a4b8504f4055ad15ba43456953d7b33c.exe

    • Size

      416KB

    • MD5

      41de8e3e7412b6e97b60fdbfdd24b0ba

    • SHA1

      fa48e5a86b5f2b04b79f6c3459339a16c2db6aaa

    • SHA256

      480b540cb344d74306d03347658b2018a4b8504f4055ad15ba43456953d7b33c

    • SHA512

      d25d39fcbbc59677f4090ac5422c121d45c2085bfdb16adb7f8854a365636ac7baf42f74ccb435e11b1c355c83c28d80bfb58d8495e0d5ab2f59f3987390a1d5

    • SSDEEP

      12288:BFc5MyBQNGCCIYu7GJ9QICQfEHVmJspao:BOdWNYIx7W90uEao

    • Detect ZGRat V1

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Stealc

      Stealc is an infostealer written in C++.

    • ZGRat

      ZGRat is remote access trojan written in C#.

    • Detects encrypted or obfuscated .NET executables

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks