Overview

overview

10

Static

static

1

YT#payment...11.exe

windows7-x64

1

YT#payment...11.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    YT#payment_705427_82908_04321_983653_37510_0975211.gz

  • Size

    35KB

  • Sample

    240510-mm9xwsda46

  • MD5

    4862892e997da3ce790745f253673c76

  • SHA1

    96b2fe8aafc48565e42d82a1522d56e8e770e75a

  • SHA256

    96b67999e3f0a8105cc90ad4fc2180b0bf2137ff7d0ce11d894b122be307decf

  • SHA512

    2ce654ba2a346bf3bd4fcd2ee823a47a6f6172b91e7b766a4e91a8a0931ebd3310e906c020464c60039a9da972a2f4ead9ae49efa690646935167c30ff4665ca

  • SSDEEP

    768:AMJ+GJ1QdUCAMKxpidwGkHJ6UjfGeL8F6GYZtxm4nNN/6x76uKy:AM0WpxpidwRH1p8F2ZtxiN6dy

Score
10/10
zgratcollectionratspywarestealer

Malware Config

Targets

    • Target

      YT#payment_705427_82908_04321_983653_37510_0975211.exe

    • Size

      73KB

    • MD5

      bad18478169b1e5d1a4e9f55a105bc94

    • SHA1

      acd5a2f2a4d386b35d68be8c0aa6f19bbe01b8f4

    • SHA256

      fd20c43c250724b2fa1ce40b7edc6e8616f6a63573da5b04fd87a307b02333c8

    • SHA512

      66d24b16442b61666c0d57464d1ecbd70089094a24a91a75c11f95a79b23440012e6ec74aed32f27b9b63494b0d513b82d11fd9d234be28a6f986b8bf3aa41a0

    • SSDEEP

      1536:KcHADLysy+7f1CEqJ+VLTeNhmZpfmd/PqiDf075Eeii:5ADmsy49xLTw+8qM25r/

    Score
    10/10
    zgratcollectionratspywarestealer

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Drops startup file

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks