General

  • Target

    fe396a1237d49be994cea981a0634f8535736c67942d050b43dca2c38038de52

  • Size

    1.4MB

  • Sample

    240515-bk9zbsab95

  • MD5

    32769244b3c9180aaeda9bdbc94e3c28

  • SHA1

    a76ee5e814514bcdce374b2a12adb69f216be63c

  • SHA256

    fe396a1237d49be994cea981a0634f8535736c67942d050b43dca2c38038de52

  • SHA512

    6cf72600a174d64eb1f3513dbeeb4c445c619a2352836705796e7f636082b9178d99d08e7c7e6ff8162617b41e9ffc0f609a00916f0fb2a7d91ab499d3717f43

  • SSDEEP

    24576:E3mJ4QH5npAbbt89g6lkRcHc/7jVt6G+xJKr6AOALfrSUv15gmm7kqQILp52HTbN:E3Y59rlkRH/7CG+xJZAOALfrSUv15gmz

Malware Config

Targets

    • Target

      fe396a1237d49be994cea981a0634f8535736c67942d050b43dca2c38038de52

    • Size

      1.4MB

    • MD5

      32769244b3c9180aaeda9bdbc94e3c28

    • SHA1

      a76ee5e814514bcdce374b2a12adb69f216be63c

    • SHA256

      fe396a1237d49be994cea981a0634f8535736c67942d050b43dca2c38038de52

    • SHA512

      6cf72600a174d64eb1f3513dbeeb4c445c619a2352836705796e7f636082b9178d99d08e7c7e6ff8162617b41e9ffc0f609a00916f0fb2a7d91ab499d3717f43

    • SSDEEP

      24576:E3mJ4QH5npAbbt89g6lkRcHc/7jVt6G+xJKr6AOALfrSUv15gmm7kqQILp52HTbN:E3Y59rlkRH/7CG+xJZAOALfrSUv15gmz

    • Detect ZGRat V1

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • ZGRat

      ZGRat is remote access trojan written in C#.

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks