General

  • Target

    d14f4b8b71b645f1f6b3ec2530d9c2d0.bin

  • Size

    273KB

  • Sample

    240429-cbanjseh44

  • MD5

    eb2afdbcb09432fe4d494465ab076753

  • SHA1

    a938ed6cead095439873ed5bf8e01a56e0bf0f3a

  • SHA256

    4e1073bf28e33f35d01ce2bbd5dd813bd395cc91929f12ebfab0b1b4badc4acb

  • SHA512

    94ebac568f288e8e97e58af55c538c02ed05d7e1c1772cf8a8b00f8a6f5c8bd839fdc2a3204dcee48c5f424e173789126f9f362c586fd39407f6ffb931908652

  • SSDEEP

    6144:eCUDc3ASDa/abPIhsPNYEwZz5kRKpn4viygO7ccX5FCsyH:GpKkOPU2YR+REcDCcX5ZyH

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.150

Attributes
  • url_path

    /c698e1bc8a2f5e6d.php

Targets

    • Target

      069bebac87e5c2bf6e4c4bfb52a8731e1a98867a3bf1214e56da9ee7f86a62ec.exe

    • Size

      347KB

    • MD5

      d14f4b8b71b645f1f6b3ec2530d9c2d0

    • SHA1

      c62d3a73ecff3337e59d1ecfcbfd3da77a8ca933

    • SHA256

      069bebac87e5c2bf6e4c4bfb52a8731e1a98867a3bf1214e56da9ee7f86a62ec

    • SHA512

      979b3f4faadf1ef7cf97d9d1fac1518c5307e10ee52a2c74406282f95c1811b075b226029fc5ceb56e1104ed1d43c2db51ed2d9a37d9153a8a532b0bd8683457

    • SSDEEP

      6144:8o+4WgjZb/JFOtrrcQfDowFsTPgZvaRGbmDgAsWrJhUN5m8BOF:5ZjZb/JfQboRTAvaYykBAfFF

    • Detect ZGRat V1

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • Stealc

      Stealc is an infostealer written in C++.

    • ZGRat

      ZGRat is remote access trojan written in C#.

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks