General

  • Target

    debitar_diarias.js

  • Size

    464KB

  • Sample

    231012-jkb2asgf72

  • MD5

    552b4a922bbef46373dd3042c7b6a6c7

  • SHA1

    9cf93f1b3b5c39f46ed62183fc73ff0f80700c23

  • SHA256

    8e792471355b42e56a05e58ef2cb62f2572bda8db9740ae8526c99e3db41078b

  • SHA512

    4cd0c9bda90fdf00d6b373e0a1015169413de69f3a9d25c00d2bef71b0f36e053335be08958729355042c5e598477e9a812ed511edfdd937fffa1aa59c22192f

  • SSDEEP

    768:7W77777977777977777977777s7777797777797777797777797777797777797N:7lSRHnlL1Gsu

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://uploaddeimagens.com.br/images/004/611/936/original/new_image_rump_js.jpg?1695057372

exe.dropper

https://uploaddeimagens.com.br/images/004/611/936/original/new_image_rump_js.jpg?1695057372

Targets

    • Target

      debitar_diarias.js

    • Size

      464KB

    • MD5

      552b4a922bbef46373dd3042c7b6a6c7

    • SHA1

      9cf93f1b3b5c39f46ed62183fc73ff0f80700c23

    • SHA256

      8e792471355b42e56a05e58ef2cb62f2572bda8db9740ae8526c99e3db41078b

    • SHA512

      4cd0c9bda90fdf00d6b373e0a1015169413de69f3a9d25c00d2bef71b0f36e053335be08958729355042c5e598477e9a812ed511edfdd937fffa1aa59c22192f

    • SSDEEP

      768:7W77777977777977777977777s7777797777797777797777797777797777797N:7lSRHnlL1Gsu

    Score
    10/10
    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

MITRE ATT&CK Enterprise v15

Tasks