General

  • Target

    fd50385e974c00299e54e10c8e1ee8db4e717562035cff3f2341c60a5d071a0d

  • Size

    407KB

  • Sample

    240507-x2kxesea85

  • MD5

    af3a6c8c8575a900edf689baac92c329

  • SHA1

    f3af1034a0c238892ac1041f8fa2637b644704e5

  • SHA256

    fd50385e974c00299e54e10c8e1ee8db4e717562035cff3f2341c60a5d071a0d

  • SHA512

    67cfe30d1ec7cb7aa33348e32e6936959a842b612bfc6f79e291097f2e4e35ba9128f9af6cc8db0ea3411e8f76f3b0abf5d0a58b1e856d33511d6fa677f0eee3

  • SSDEEP

    6144:OYNTarFOqusAPfwQzYGEfmEPOa9oBWPjuz3UlrAM0WHfa:nNkFnAHZvEfmEPOak0jMgr7a

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.150

Attributes
  • url_path

    /c698e1bc8a2f5e6d.php

Targets

    • Target

      fd50385e974c00299e54e10c8e1ee8db4e717562035cff3f2341c60a5d071a0d

    • Size

      407KB

    • MD5

      af3a6c8c8575a900edf689baac92c329

    • SHA1

      f3af1034a0c238892ac1041f8fa2637b644704e5

    • SHA256

      fd50385e974c00299e54e10c8e1ee8db4e717562035cff3f2341c60a5d071a0d

    • SHA512

      67cfe30d1ec7cb7aa33348e32e6936959a842b612bfc6f79e291097f2e4e35ba9128f9af6cc8db0ea3411e8f76f3b0abf5d0a58b1e856d33511d6fa677f0eee3

    • SSDEEP

      6144:OYNTarFOqusAPfwQzYGEfmEPOa9oBWPjuz3UlrAM0WHfa:nNkFnAHZvEfmEPOak0jMgr7a

    • Detect ZGRat V1

    • Stealc

      Stealc is an infostealer written in C++.

    • ZGRat

      ZGRat is remote access trojan written in C#.

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks