General

  • Target

    b9eb50a61176fa0fe1480783790db82dadf07f42a7b50ef5a270980878866ae9

  • Size

    406KB

  • Sample

    240426-fnrz5sab9y

  • MD5

    80a74f523dc33b1778efc7f1e4c595b5

  • SHA1

    e14cfee9d63914b780f994570af0606c360dcb7d

  • SHA256

    b9eb50a61176fa0fe1480783790db82dadf07f42a7b50ef5a270980878866ae9

  • SHA512

    c801123ddb60c4799a0728e9f629de6fb3c14e07ab359c71916820bb109d4d2619b100f0bc2db402b91109d14199d1a7460173d0853a3196befd1d6b7d5fe2e0

  • SSDEEP

    12288:vnCNuxzdlcGaoloHcJu4ysZCRzh8nkIr9:vCGdleCCgCRCnkIr9

Malware Config

Targets

    • Target

      b9eb50a61176fa0fe1480783790db82dadf07f42a7b50ef5a270980878866ae9

    • Size

      406KB

    • MD5

      80a74f523dc33b1778efc7f1e4c595b5

    • SHA1

      e14cfee9d63914b780f994570af0606c360dcb7d

    • SHA256

      b9eb50a61176fa0fe1480783790db82dadf07f42a7b50ef5a270980878866ae9

    • SHA512

      c801123ddb60c4799a0728e9f629de6fb3c14e07ab359c71916820bb109d4d2619b100f0bc2db402b91109d14199d1a7460173d0853a3196befd1d6b7d5fe2e0

    • SSDEEP

      12288:vnCNuxzdlcGaoloHcJu4ysZCRzh8nkIr9:vCGdleCCgCRCnkIr9

    • Detect ZGRat V1

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Stealc

      Stealc is an infostealer written in C++.

    • ZGRat

      ZGRat is remote access trojan written in C#.

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks