Overview

overview

10

Static

static

3

New Order.exe

windows7-x64

10

New Order.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1199d6b3ce577b7a69ad507cf36a7d8b_JaffaCakes118

  • Size

    812KB

  • Sample

    240504-ht87qaeg61

  • MD5

    1199d6b3ce577b7a69ad507cf36a7d8b

  • SHA1

    9fcee8476a3068660ef769e343addbf6aeef0ea4

  • SHA256

    2fe76f953de7338f202e10237e3a43639663429dde38d3a69c1c577ccdc61d2a

  • SHA512

    f4a5c82766ca0b5a482abcd8f254e2dfe6391dedacb04f8316d6c3c97e7e2e1bcfceff6c325d2956c3c40522aca63b5b2eb732faed41bf5658740bf3bb44ccf2

  • SSDEEP

    12288:hXLalRJN4sKRuqo8+mZTuDeoAlxbKrGxb+j3vJEu1qGiXxAsVPKcabqWjwfY7:62sKonmtu2xbKSQhbjaB1akA7

Score
10/10
massloggerzgratcollectionevasionratrezer0spywarestealer

Malware Config

Targets

    • Target

      New Order.exe

    • Size

      852KB

    • MD5

      61763eb6479d4859723720ef50e910b7

    • SHA1

      17b75ac6c43a1f3953ee3f0eaab4c3f7b47fddb5

    • SHA256

      5c3dc2f467e51b4a48a9bf1f068fe562b5d9687780da0fdb35c8f5836df0a550

    • SHA512

      d397197e7dd81bc7b341c018b1edc723dcb18eab899b536e4a3e8621ee8e01e593b23c2cdbd533ea61f5c5e1ab68688da756423fd7713f4665906341dc68a0eb

    • SSDEEP

      12288:AC7EMuLtRjRJN4+KzCqamEmZTu1saAlnbGZixL+1zvpYAzqwiZRislPKiabMKjQS:ACHu32+KgPmtuenbGeoNPH4D7ak2b

    Score
    10/10
    massloggerzgratcollectionevasionratrezer0spywarestealer

    • Detect ZGRat V1

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

      stealerspywaremasslogger

    • MassLogger Main payload

    • Modifies visibility of file extensions in Explorer

      evasion

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • ReZer0 packer

      Detects ReZer0, a packer with multiple versions used in various campaigns.

      rezer0

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks