General

  • Target

    ed178bcbabb10ed904b432c53d08aa215a07511889dfc34225dd852c088a833e.exe

  • Size

    455KB

  • Sample

    240429-b71n6seg25

  • MD5

    16c626e0e471d1c6ee394c06c36c7b94

  • SHA1

    e0553e3ef1c67110ebfcaca33b071d8a0fde0c09

  • SHA256

    ed178bcbabb10ed904b432c53d08aa215a07511889dfc34225dd852c088a833e

  • SHA512

    d2d56d5cbe4582b4416bc6b67e2e8cb04bdbe1f3e07d178c7c8467b41eb9b6e1e8367e33b716bf3c9af18c1ef3787f94fcf027665c170cd9502101acd47da0db

  • SSDEEP

    6144:dndKNo69iOHScmTvdTtWxM0xJe5oTBCLV9n7s3ODE2:dnsN9SJZTtWxM0T3cnI3wE2

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.150

Attributes
  • url_path

    /c698e1bc8a2f5e6d.php

Targets

    • Target

      ed178bcbabb10ed904b432c53d08aa215a07511889dfc34225dd852c088a833e.exe

    • Size

      455KB

    • MD5

      16c626e0e471d1c6ee394c06c36c7b94

    • SHA1

      e0553e3ef1c67110ebfcaca33b071d8a0fde0c09

    • SHA256

      ed178bcbabb10ed904b432c53d08aa215a07511889dfc34225dd852c088a833e

    • SHA512

      d2d56d5cbe4582b4416bc6b67e2e8cb04bdbe1f3e07d178c7c8467b41eb9b6e1e8367e33b716bf3c9af18c1ef3787f94fcf027665c170cd9502101acd47da0db

    • SSDEEP

      6144:dndKNo69iOHScmTvdTtWxM0xJe5oTBCLV9n7s3ODE2:dnsN9SJZTtWxM0T3cnI3wE2

    • Detect ZGRat V1

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Stealc

      Stealc is an infostealer written in C++.

    • ZGRat

      ZGRat is remote access trojan written in C#.

    • Detect binaries embedding considerable number of MFA browser extension IDs.

    • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

    • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

    • Detects encrypted or obfuscated .NET executables

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks