Overview

overview

10

Static

static

3

Dhl-02.exe

windows7-x64

10

Dhl-02.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d178b0f34c3a81d17556b5dddb468846dddc1b77a507df935a7bec3224b8a1ca.img

  • Size

    6.1MB

  • Sample

    240511-kfg77ahb4v

  • MD5

    0d24dafcbb977d2f3e0f1f92dd51eff4

  • SHA1

    a5696d340c7859b490d489b9f9f30d1f37f2172b

  • SHA256

    d178b0f34c3a81d17556b5dddb468846dddc1b77a507df935a7bec3224b8a1ca

  • SHA512

    6378036da1253efeb7a8fbcd4969ef30eddf159a98abc3a0dc2381f7f685ddbbfb695d0195631925360596258f65ba9f3826821cb8b993631292b4813f34d7e0

  • SSDEEP

    24576:audIAccuoodT1Exb/4rNYRxJ3//XAO81DnemJnwRS64uvRdT7dk9pagnJr8gMEyR:3

Score
10/10
zgratcollectionpersistenceratspywarestealer

Malware Config

Targets

    • Target

      Dhl-02.exe

    • Size

      6.1MB

    • MD5

      d9a34070f5445a2f4c1fa7dcb45e0ab4

    • SHA1

      f6c56df6c755f1c0b45448690465a5e2e06275ce

    • SHA256

      42b3403fdb432bb35c9371b14f7ce6a5ea5d4728997381b349ab33b1b58f4aa1

    • SHA512

      5429daadd697fff888727238d725ff86f8d1ea3e7f29e7faa0a5bbb3f2966ff126d9f7c83b64ac63e3e9d93d69983d21032b64cd280215d28d15d818d55e516c

    • SSDEEP

      24576:OudIAccuoodT1Exb/4rNYRxJ3//XAO81DnemJnwRS64uvRdT7dk9pagnJr8gMEyR:b

    Score
    10/10
    zgratpersistenceratcollectionspywarestealer

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks