General
-
Target
f49442114e419f35e5ff26df22c640d4d4aad8c365eb7445a4c95e25b681f177
-
Size
421KB
-
Sample
240411-qjxpyafd6t
-
MD5
79933e52220b6f2c33139bd6d88ac60f
-
SHA1
95784c90477d3148237340388b9b17a6ec204abc
-
SHA256
f49442114e419f35e5ff26df22c640d4d4aad8c365eb7445a4c95e25b681f177
-
SHA512
df9729a0b53ab90f611098dc797afe6b28e1bbc8110655f27ec23304e1df888e88076946d4c638e0f4396e83cc6fe4205d6aba56958430f69a5da8f680f4abd2
-
SSDEEP
6144:dTEaPApTHrDctwURg7V02yQIeEFqC2yv20gaYngYj7+smQCkhYElq+l:LPGTLIaUEm2yQ7TmzgaAgYj7nhDYyxl
Malware Config
Targets
-
-
Target
f49442114e419f35e5ff26df22c640d4d4aad8c365eb7445a4c95e25b681f177
-
Size
421KB
-
MD5
79933e52220b6f2c33139bd6d88ac60f
-
SHA1
95784c90477d3148237340388b9b17a6ec204abc
-
SHA256
f49442114e419f35e5ff26df22c640d4d4aad8c365eb7445a4c95e25b681f177
-
SHA512
df9729a0b53ab90f611098dc797afe6b28e1bbc8110655f27ec23304e1df888e88076946d4c638e0f4396e83cc6fe4205d6aba56958430f69a5da8f680f4abd2
-
SSDEEP
6144:dTEaPApTHrDctwURg7V02yQIeEFqC2yv20gaYngYj7+smQCkhYElq+l:LPGTLIaUEm2yQ7TmzgaAgYj7nhDYyxl
Score10/10-
Buer
Buer is a new modular loader first seen in August 2019.
-
Detect ZGRat V1
-
Stealc
Stealc is an infostealer written in C++.
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-