Overview

overview

10

Static

static

10

b86ca52b51...6f.exe

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b86ca52b5137070fecf0f62413e67427bb325b68c67677085b4945394edb416f

  • Size

    3.6MB

  • Sample

    231030-fa82hacf69

  • MD5

    ae6fa9bafb66f9f7abef04452e02bc1c

  • SHA1

    9ef051f253f58a97df773d3ab14654320191a08d

  • SHA256

    b86ca52b5137070fecf0f62413e67427bb325b68c67677085b4945394edb416f

  • SHA512

    098dd73c9f75fd90ceb897f487d80c556456246ced0880057a317dd07c96900ab217cff500e363aa27e2debdde639f0be492ae84eabfd55846cbbf2b8cbd238c

  • SSDEEP

    49152:IBJ7Cz5hm/qbhLLVAaM0+aSp0a+utgmvaIQLk7vsFMT2QbZCsL5A+rTpeZicE:ypCz5hvLqa3fSp0a+u6mt6cZnFDeEf

Score
10/10
zgratpersistenceratspywarestealer

Malware Config

Targets

    • Target

      b86ca52b5137070fecf0f62413e67427bb325b68c67677085b4945394edb416f

    • Size

      3.6MB

    • MD5

      ae6fa9bafb66f9f7abef04452e02bc1c

    • SHA1

      9ef051f253f58a97df773d3ab14654320191a08d

    • SHA256

      b86ca52b5137070fecf0f62413e67427bb325b68c67677085b4945394edb416f

    • SHA512

      098dd73c9f75fd90ceb897f487d80c556456246ced0880057a317dd07c96900ab217cff500e363aa27e2debdde639f0be492ae84eabfd55846cbbf2b8cbd238c

    • SSDEEP

      49152:IBJ7Cz5hm/qbhLLVAaM0+aSp0a+utgmvaIQLk7vsFMT2QbZCsL5A+rTpeZicE:ypCz5hvLqa3fSp0a+u6mt6cZnFDeEf

    Score
    10/10
    zgratpersistenceratspywarestealer

    • Detect ZGRat V1

    • Modifies WinLogon for persistence

      persistence

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks