Overview

overview

10

Static

static

3

PO_2345676...VX.exe

windows7-x64

10

PO_2345676...VX.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    179dcbc99ff067f988b401037825a4f9_JaffaCakes118

  • Size

    841KB

  • Sample

    240505-pd5mxshf6v

  • MD5

    179dcbc99ff067f988b401037825a4f9

  • SHA1

    c2fa681a45038ba80024192c0ddb7a4dffa70868

  • SHA256

    4c1fcffd0d8ecce841bde1961d6ac50e9e68b18eaf09be257a2ef150c3562030

  • SHA512

    78071cb829a814803d74229ebd5ae4d233caf82dfb74bd63de7530d167fad6ddb666ef6f3a4bbdf081c23c3c44214a42e19521bf4fe48a18ca545d468af5e687

  • SSDEEP

    12288:hR51q/+yZJ+IGXqXZOqgLhJ9aEODyc5zLlwhc2cVurA0ZX4Pc8NHrL:F1q8IGfqgAEO9lLlUcVj0R38NHrL

Score
10/10
zgratcollectionexecutionratspywarestealer

Malware Config

Targets

    • Target

      PO_23456765434567654VX.exe

    • Size

      840KB

    • MD5

      ece384609530cfe4879ef647cf5f80f7

    • SHA1

      9c1eaef97e84e8243671151eb8be4651f8fb0931

    • SHA256

      dd9578bf2f168472dc3da2f580a6384f997fe01149e94ca7e7b31448ddac60bc

    • SHA512

      c6aa6c3095b703747469003540c47453380de92ee926a8b5d4e20011e7db20b09a16d36117c4ecc78a9b30b65020341ae26fe27e30bab9301273e13ad3d37a7e

    • SSDEEP

      12288:OR51q/+yZJ+IGXqXZOqgLhJ9aEODyc5zLlwhc2cVurA0ZX4Pc8NHrL:w1q8IGfqgAEO9lLlUcVj0R38NHrL

    Score
    10/10
    zgratcollectionexecutionratspywarestealer

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

      spywarestealer

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks