General

  • Target

    Zilcorp_PayCheck.js

  • Size

    415KB

  • Sample

    240618-lkcnyasajl

  • MD5

    b7bef63b1d36f38f696469ace03c61c4

  • SHA1

    6354ac040b6fda031ebf37e90eae9eb68b97bd94

  • SHA256

    201483f282a58582d9a11ac56491bd74bd25caa0635987297d6cc985f4078bea

  • SHA512

    a94833b8df108d34f39c87377ab0f46a81774056e40e45f34e504c25ed7e99e647a4622b30be7096e526e1a359a69c99261f69805cc7e956d8bc4f865a3ffd45

  • SSDEEP

    6144:XQ6gcED4sXas+CryilhnTUX5jcniqlSu+yxq3RKN24mR1V3JMV9DLC7:g688sXasSsUXiXEwgLcLC7

Malware Config

Targets

    • Target

      Zilcorp_PayCheck.js

    • Size

      415KB

    • MD5

      b7bef63b1d36f38f696469ace03c61c4

    • SHA1

      6354ac040b6fda031ebf37e90eae9eb68b97bd94

    • SHA256

      201483f282a58582d9a11ac56491bd74bd25caa0635987297d6cc985f4078bea

    • SHA512

      a94833b8df108d34f39c87377ab0f46a81774056e40e45f34e504c25ed7e99e647a4622b30be7096e526e1a359a69c99261f69805cc7e956d8bc4f865a3ffd45

    • SSDEEP

      6144:XQ6gcED4sXas+CryilhnTUX5jcniqlSu+yxq3RKN24mR1V3JMV9DLC7:g688sXasSsUXiXEwgLcLC7

    • STRRAT

      STRRAT is a remote access tool than can steal credentials and log keystrokes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Modifies file permissions

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks