Overview

overview

10

Static

static

1

Aquantia_S...21.exe

windows11-21h2-x64

10

Resubmissions

12-05-2024 16:17

240512-trvr4adh71 10

12-05-2024 16:04

240512-th9vnade4x 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Aquantia_Setup 2.21.exe

  • Size

    368KB

  • Sample

    240512-trvr4adh71

  • MD5

    f77b3165615ad09f0dec44af2746fc36

  • SHA1

    7b6bc037c7c82534805a739e93a14a34cffb15de

  • SHA256

    ee348f845ad37552a32b0643002b39614abab46eb7cba0788a4fe75ce5191c6c

  • SHA512

    a002681e303d6ffa165e9500c9a64e23ccda58f503d182d397f25cf9661fa2268a6da750f7af12eac1d90c3fe7c2853f0ba8f2f42badd8a353fac176774a5565

  • SSDEEP

    6144:su1A7hb59pvaOKDpV1aUDTssIIE4dnW4hqHAJwtPzhAgr7NHiNI6espZ:sQAX9Qr1aUD4s8ZzKgoaPspZ

Score
10/10
redlinezgratdiscoveryinfostealerratspywarestealer

Malware Config

Targets

    • Target

      Aquantia_Setup 2.21.exe

    • Size

      368KB

    • MD5

      f77b3165615ad09f0dec44af2746fc36

    • SHA1

      7b6bc037c7c82534805a739e93a14a34cffb15de

    • SHA256

      ee348f845ad37552a32b0643002b39614abab46eb7cba0788a4fe75ce5191c6c

    • SHA512

      a002681e303d6ffa165e9500c9a64e23ccda58f503d182d397f25cf9661fa2268a6da750f7af12eac1d90c3fe7c2853f0ba8f2f42badd8a353fac176774a5565

    • SSDEEP

      6144:su1A7hb59pvaOKDpV1aUDTssIIE4dnW4hqHAJwtPzhAgr7NHiNI6espZ:sQAX9Qr1aUD4s8ZzKgoaPspZ

    Score
    10/10
    redlinezgratdiscoveryinfostealerratspywarestealer

    • Detect ZGRat V1

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks