Behavioral task
behavioral1
Sample
16946187077d5a55717401963e9a187640d096855b4786a0d8f1aac1819dc5463a39066979851.dat-decoded.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
16946187077d5a55717401963e9a187640d096855b4786a0d8f1aac1819dc5463a39066979851.dat-decoded.dll
Resource
win10v2004-20230915-en
General
-
Target
16946187077d5a55717401963e9a187640d096855b4786a0d8f1aac1819dc5463a39066979851.dat-decoded.dll
-
Size
72KB
-
MD5
2a048a7d6c0dab891aa81ee249bbb9a6
-
SHA1
15d6a9b88b85eca7671c3b337347badedb12931e
-
SHA256
5c03d43bf03feb867d7738b2697d9d44fe09fc2d97e681559f09cfa998ec0d77
-
SHA512
a7b6befa22dd779398fe97843345ffe3e04e5e4c0253499fa94dd465cfb81b6c5d6f288077aa380dde907301e4ac50bf9bc5d6c9a212bcd6800a56a2d5651e92
-
SSDEEP
768:sag5iqImBLv2w+J/lxeD9ygg87DzexJV5I0P35yDyzblEDwt7J3FwwT/tj9lYRs8:k4mBLv7IeRP3EF3t7J1ZT/tBlZaQOt
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
resource yara_rule sample family_zgrat_v1 -
Zgrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 16946187077d5a55717401963e9a187640d096855b4786a0d8f1aac1819dc5463a39066979851.dat-decoded.dll
Files
-
16946187077d5a55717401963e9a187640d096855b4786a0d8f1aac1819dc5463a39066979851.dat-decoded.dll.dll windows:4 windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mscoree
_CorDllMain
Sections
.text Size: 70KB - Virtual size: 69KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 868B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ