General
- Target 41eb611f2e592a808b4397f252e1767d.bin
- Size 427KB
- Sample240428-blejtacf72
- SHA256 f02bd322438f7b91ebb664964dffc7094887d9aac8e4e213bf4c909da6829483
Score
10/10
Malware Config
Targets
-
- Target PAYMENT_ERROR.PDF.exe
- Size 1.0MB
- SHA256 0ecc90be340405861b10203bea0cf2fe20b621387d5c0bbc3bfd305d106e51e0
Score10/10Detect ZGRat V1
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
ZGRat
ZGRat is remote access trojan written in C#.
ModiLoader Second Stage
Executes dropped EXE
Loads dropped DLL
Reads WinSCP keys stored on the system
Tries to access WinSCP stored sessions.
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Adds Run key to start application
Suspicious use of SetThreadContext