Overview

overview

10

Static

static

1

LucidSwapper.zip

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    LucidSwapper.zip

  • Size

    16.4MB

  • Sample

    240515-kvarnahh61

  • MD5

    5e3f7d7cd2a9e777c7715b4113be0e9c

  • SHA1

    e8b8b6da84866bf8f52d250370d69cd8b7e374e8

  • SHA256

    4bf36954d0e3a086f4ea0a2f54ead1afc474a7e145296dd3e13c9a23db3e7bac

  • SHA512

    17b65231264848d249e86d647ca5f5fdb2b4a707b8108f81b1770daae9e0655c03ed44479bc2ad4b625eddc0ef2e62da5a0f7030c8a1c380600f343fb8a2b910

  • SSDEEP

    393216:MBJ79H3N9bPsbw7FBzILfllYfFQVxse3VoOx:MBN9d97tRBzskfFEsGB

Score
10/10
redlinezgratdiscoveryinfostealerratspywarestealer

Malware Config

Targets

    • Target

      LucidSwapper.zip

    • Size

      16.4MB

    • MD5

      5e3f7d7cd2a9e777c7715b4113be0e9c

    • SHA1

      e8b8b6da84866bf8f52d250370d69cd8b7e374e8

    • SHA256

      4bf36954d0e3a086f4ea0a2f54ead1afc474a7e145296dd3e13c9a23db3e7bac

    • SHA512

      17b65231264848d249e86d647ca5f5fdb2b4a707b8108f81b1770daae9e0655c03ed44479bc2ad4b625eddc0ef2e62da5a0f7030c8a1c380600f343fb8a2b910

    • SSDEEP

      393216:MBJ79H3N9bPsbw7FBzILfllYfFQVxse3VoOx:MBN9d97tRBzskfFEsGB

    Score
    10/10
    redlinezgratdiscoveryinfostealerratspywarestealer

    • Detect ZGRat V1

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks