General
-
Target
b9834e16d247d286220c7bfd1550c386.exe
-
Size
457KB
-
Sample
240428-kwky1scd2s
-
MD5
b9834e16d247d286220c7bfd1550c386
-
SHA1
19e54a921452dd1b0999e1d2b3165e0f02a2007b
-
SHA256
17a5454359eda2cbf552fa8779228079df38238974a39d02f2292e3c6d224a2b
-
SHA512
400d79fb3f64fee02a27abd1c7c641480e1f2df05d0b593b0e3745e1ff071a8ac6209c71c285e50417795006300a75fa35a09c93a42488bb03f35b91b3dfc1a6
-
SSDEEP
6144:xH1aphP6ZxqlnU3ijOJj58v9X6/7rYlce7nVElm2Et6pdK:xVanaIlnUBKvF64lVXupdK
Static task
static1
Behavioral task
behavioral1
Sample
b9834e16d247d286220c7bfd1550c386.exe
Resource
win7-20240215-en
Malware Config
Extracted
stealc
http://185.172.128.62
-
url_path
/902e53a07830e030.php
Targets
-
-
Target
b9834e16d247d286220c7bfd1550c386.exe
-
Size
457KB
-
MD5
b9834e16d247d286220c7bfd1550c386
-
SHA1
19e54a921452dd1b0999e1d2b3165e0f02a2007b
-
SHA256
17a5454359eda2cbf552fa8779228079df38238974a39d02f2292e3c6d224a2b
-
SHA512
400d79fb3f64fee02a27abd1c7c641480e1f2df05d0b593b0e3745e1ff071a8ac6209c71c285e50417795006300a75fa35a09c93a42488bb03f35b91b3dfc1a6
-
SSDEEP
6144:xH1aphP6ZxqlnU3ijOJj58v9X6/7rYlce7nVElm2Et6pdK:xVanaIlnUBKvF64lVXupdK
-
Detect ZGRat V1
-
SectopRAT payload
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-