Behavioral task
behavioral1
Sample
0bc0fc434c974347405807f0f8089c1b0c96710d2f7eaf88aa96ac9e03e4e95d.exe
Resource
win7-20231023-en
General
-
Target
0bc0fc434c974347405807f0f8089c1b0c96710d2f7eaf88aa96ac9e03e4e95d
-
Size
1.6MB
-
MD5
0b2bd1794decf5ff578b4082c81fcbe8
-
SHA1
4c1b6e00411464b73a04967dcc3d1b55096596fc
-
SHA256
0bc0fc434c974347405807f0f8089c1b0c96710d2f7eaf88aa96ac9e03e4e95d
-
SHA512
c57aaa034a60d9d0e815394a2653662b1c29cfdbf32faf95c15b1f85bd94a05b84b2db37b7e7d9b99af9a504549dd0f0080bfc86638d700f95de9df3c82c2ada
-
SSDEEP
24576:XrQ5QLlL33+TciubJLtSDAug34zEEcFAlNoIEdaPQSLWwgvmkT:Xrp0u5tSDAYoZaIHfmy
Malware Config
Signatures
-
Detect ZGRat V2 1 IoCs
Processes:
resource yara_rule sample family_zgrat_v2 -
Zgrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 0bc0fc434c974347405807f0f8089c1b0c96710d2f7eaf88aa96ac9e03e4e95d
Files
-
0bc0fc434c974347405807f0f8089c1b0c96710d2f7eaf88aa96ac9e03e4e95d.exe windows:4 windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 162KB - Virtual size: 162KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ