General

  • Target

    bd7df1cb2a16dac8bf9352a5345186e8ec9b1338aeac506003aed8f53d005eff

  • Size

    417KB

  • Sample

    240506-mat1xabh67

  • MD5

    8559a8e41733cc6441febaf102bcef29

  • SHA1

    aa8a1256988c97242674fec0ef1fb1279830f06b

  • SHA256

    bd7df1cb2a16dac8bf9352a5345186e8ec9b1338aeac506003aed8f53d005eff

  • SHA512

    727fead6c7bff267bc18f80c61e2b14e1bc45a919b5a3444b1ee11906d8addb44a79ee548c3a528903df7b3c9dd188071c57b5de4864bfbe2ce3b33a49f39615

  • SSDEEP

    6144:d5pk6VtVbGU1sVOzp0f1eYVwIuI84glzNwiaTSLrqi3Vta5I:d5pjVLbX0ONzYarI0lzhaT+RVtMI

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.150

Attributes
  • url_path

    /c698e1bc8a2f5e6d.php

Targets

    • Target

      bd7df1cb2a16dac8bf9352a5345186e8ec9b1338aeac506003aed8f53d005eff

    • Size

      417KB

    • MD5

      8559a8e41733cc6441febaf102bcef29

    • SHA1

      aa8a1256988c97242674fec0ef1fb1279830f06b

    • SHA256

      bd7df1cb2a16dac8bf9352a5345186e8ec9b1338aeac506003aed8f53d005eff

    • SHA512

      727fead6c7bff267bc18f80c61e2b14e1bc45a919b5a3444b1ee11906d8addb44a79ee548c3a528903df7b3c9dd188071c57b5de4864bfbe2ce3b33a49f39615

    • SSDEEP

      6144:d5pk6VtVbGU1sVOzp0f1eYVwIuI84glzNwiaTSLrqi3Vta5I:d5pjVLbX0ONzYarI0lzhaT+RVtMI

    • Detect ZGRat V1

    • Stealc

      Stealc is an infostealer written in C++.

    • ZGRat

      ZGRat is remote access trojan written in C#.

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks