General
-
Target
bd7df1cb2a16dac8bf9352a5345186e8ec9b1338aeac506003aed8f53d005eff
-
Size
417KB
-
Sample
240506-mat1xabh67
-
MD5
8559a8e41733cc6441febaf102bcef29
-
SHA1
aa8a1256988c97242674fec0ef1fb1279830f06b
-
SHA256
bd7df1cb2a16dac8bf9352a5345186e8ec9b1338aeac506003aed8f53d005eff
-
SHA512
727fead6c7bff267bc18f80c61e2b14e1bc45a919b5a3444b1ee11906d8addb44a79ee548c3a528903df7b3c9dd188071c57b5de4864bfbe2ce3b33a49f39615
-
SSDEEP
6144:d5pk6VtVbGU1sVOzp0f1eYVwIuI84glzNwiaTSLrqi3Vta5I:d5pjVLbX0ONzYarI0lzhaT+RVtMI
Static task
static1
Behavioral task
behavioral1
Sample
bd7df1cb2a16dac8bf9352a5345186e8ec9b1338aeac506003aed8f53d005eff.exe
Resource
win10v2004-20240419-en
Malware Config
Extracted
stealc
http://185.172.128.150
-
url_path
/c698e1bc8a2f5e6d.php
Targets
-
-
Target
bd7df1cb2a16dac8bf9352a5345186e8ec9b1338aeac506003aed8f53d005eff
-
Size
417KB
-
MD5
8559a8e41733cc6441febaf102bcef29
-
SHA1
aa8a1256988c97242674fec0ef1fb1279830f06b
-
SHA256
bd7df1cb2a16dac8bf9352a5345186e8ec9b1338aeac506003aed8f53d005eff
-
SHA512
727fead6c7bff267bc18f80c61e2b14e1bc45a919b5a3444b1ee11906d8addb44a79ee548c3a528903df7b3c9dd188071c57b5de4864bfbe2ce3b33a49f39615
-
SSDEEP
6144:d5pk6VtVbGU1sVOzp0f1eYVwIuI84glzNwiaTSLrqi3Vta5I:d5pjVLbX0ONzYarI0lzhaT+RVtMI
-
Detect ZGRat V1
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-