Overview

overview

10

Static

static

3

Miner.exe

windows7-x64

10

Miner.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Miner.exe

  • Size

    629KB

  • Sample

    231016-gdsz5aea45

  • MD5

    708d29598abe4e2f728b3e3908e50b89

  • SHA1

    cdea35bbf332c3d062e797ab13a6e1177c0b15f0

  • SHA256

    34533f89b9779c58aa974e0b736e64e40cef220586e1f08eb03bc51565f8cf36

  • SHA512

    f06b680a1919088dfc6072839160cb3febb62d110f7553c705e0e13433123f15b67d94301bb76a2a9afbbc602959f993c1607739f0373e4d091aea60ab78d40f

  • SSDEEP

    12288:HWNoB3z0ShdTOpaRcBno+8A4Zv4Tdoyp5ujKmKaQwl:8C3z0SXTOEund8jZe5KD

Score
10/10
zgratrat

Malware Config

Targets

    • Target

      Miner.exe

    • Size

      629KB

    • MD5

      708d29598abe4e2f728b3e3908e50b89

    • SHA1

      cdea35bbf332c3d062e797ab13a6e1177c0b15f0

    • SHA256

      34533f89b9779c58aa974e0b736e64e40cef220586e1f08eb03bc51565f8cf36

    • SHA512

      f06b680a1919088dfc6072839160cb3febb62d110f7553c705e0e13433123f15b67d94301bb76a2a9afbbc602959f993c1607739f0373e4d091aea60ab78d40f

    • SSDEEP

      12288:HWNoB3z0ShdTOpaRcBno+8A4Zv4Tdoyp5ujKmKaQwl:8C3z0SXTOEund8jZe5KD

    Score
    10/10
    zgratrat

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks