General
-
Target
98cd6c9745bb25905a4339c28a8e81a8c791e1b0e922105df86d551ea9b98430
-
Size
357KB
-
Sample
240430-ajddasee74
-
MD5
4c76dfaaf34706146a73d44bf482289c
-
SHA1
07d89f3bb11d1ddace105a7ebd954b4fc079359b
-
SHA256
98cd6c9745bb25905a4339c28a8e81a8c791e1b0e922105df86d551ea9b98430
-
SHA512
87d1ebcdbaa500104f5a86194ab6645755db4ea53499bb37eed76a03293ff654683cde45932119e67649a13ec4fa0cd3975182714a8a1b87d1420c4609891c2f
-
SSDEEP
6144:C1lNMgxBrplOypd3pj4IvhGkcnokcjh+QyrmqVnUWHBNBW2dGjV5Jo:gNMgbplOq3eysDcjUrBV7doJo
Static task
static1
Behavioral task
behavioral1
Sample
98cd6c9745bb25905a4339c28a8e81a8c791e1b0e922105df86d551ea9b98430.exe
Resource
win10v2004-20240426-en
Malware Config
Extracted
stealc
http://185.172.128.150
-
url_path
/c698e1bc8a2f5e6d.php
Targets
-
-
Target
98cd6c9745bb25905a4339c28a8e81a8c791e1b0e922105df86d551ea9b98430
-
Size
357KB
-
MD5
4c76dfaaf34706146a73d44bf482289c
-
SHA1
07d89f3bb11d1ddace105a7ebd954b4fc079359b
-
SHA256
98cd6c9745bb25905a4339c28a8e81a8c791e1b0e922105df86d551ea9b98430
-
SHA512
87d1ebcdbaa500104f5a86194ab6645755db4ea53499bb37eed76a03293ff654683cde45932119e67649a13ec4fa0cd3975182714a8a1b87d1420c4609891c2f
-
SSDEEP
6144:C1lNMgxBrplOypd3pj4IvhGkcnokcjh+QyrmqVnUWHBNBW2dGjV5Jo:gNMgbplOq3eysDcjUrBV7doJo
-
Detect ZGRat V1
-
SectopRAT payload
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-