General
-
Target
39c6052f544fa39be7c80c5461085bc4a9793dba92327a3a2be213305e548885
-
Size
416KB
-
Sample
240507-hw655sea7w
-
MD5
4e602bffee9a8773c34be37e14d07353
-
SHA1
9843d1ca9f478fb54060d0413b227d0eaa1fa938
-
SHA256
39c6052f544fa39be7c80c5461085bc4a9793dba92327a3a2be213305e548885
-
SHA512
98462cf39efd2ed06de56ad387a0fc58d07a8baf747bfeff24220f23112780fd0a022c20cdb687ea40734965f1617c438f081b2ad9b38f8b8080b581ed8f57ff
-
SSDEEP
6144:uE9fYb7tyBIBFPOofY+dZLomCu9PVDro/rTsKIknXjrxPmHQTNWekuMiq:uEeHtJBFNYnKJro/rIKdXjF+w8Huq
Static task
static1
Behavioral task
behavioral1
Sample
39c6052f544fa39be7c80c5461085bc4a9793dba92327a3a2be213305e548885.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
stealc
http://185.172.128.150
-
url_path
/c698e1bc8a2f5e6d.php
Targets
-
-
Target
39c6052f544fa39be7c80c5461085bc4a9793dba92327a3a2be213305e548885
-
Size
416KB
-
MD5
4e602bffee9a8773c34be37e14d07353
-
SHA1
9843d1ca9f478fb54060d0413b227d0eaa1fa938
-
SHA256
39c6052f544fa39be7c80c5461085bc4a9793dba92327a3a2be213305e548885
-
SHA512
98462cf39efd2ed06de56ad387a0fc58d07a8baf747bfeff24220f23112780fd0a022c20cdb687ea40734965f1617c438f081b2ad9b38f8b8080b581ed8f57ff
-
SSDEEP
6144:uE9fYb7tyBIBFPOofY+dZLomCu9PVDro/rTsKIknXjrxPmHQTNWekuMiq:uEeHtJBFNYnKJro/rIKdXjF+w8Huq
-
Detect ZGRat V1
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-