Overview
overview
10Static
static
1001c7c94eea...a4.exe
windows7-x64
1001c7c94eea...a4.exe
windows10-2004-x64
901ff513f78...c9.exe
windows7-x64
1001ff513f78...c9.exe
windows10-2004-x64
101c3e4e7076...b7.exe
windows7-x64
101c3e4e7076...b7.exe
windows10-2004-x64
101ca15ecf5f...f2.exe
windows7-x64
101ca15ecf5f...f2.exe
windows10-2004-x64
101dbdabb187...e4.exe
windows7-x64
101dbdabb187...e4.exe
windows10-2004-x64
102a96ad5bd9...0c.exe
windows7-x64
102a96ad5bd9...0c.exe
windows10-2004-x64
102dd39b1e46...8e.exe
windows7-x64
32dd39b1e46...8e.exe
windows10-2004-x64
12de6d052aa...da.exe
windows7-x64
102de6d052aa...da.exe
windows10-2004-x64
103b7263328b...b4.exe
windows7-x64
103b7263328b...b4.exe
windows10-2004-x64
13b9e7f3256...ec.exe
windows7-x64
103b9e7f3256...ec.exe
windows10-2004-x64
103c5b4bb566...df.exe
windows7-x64
103c5b4bb566...df.exe
windows10-2004-x64
103cf4b6aa2b...ac.exe
windows7-x64
103cf4b6aa2b...ac.exe
windows10-2004-x64
10Behavioral task
behavioral1
Sample
01c7c94eea4220eca4d8661e32d3cba4.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
01c7c94eea4220eca4d8661e32d3cba4.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral3
Sample
01ff513f788e2f8964c2db9d58a2e3c9.exe
Resource
win7-20231020-en
Behavioral task
behavioral4
Sample
01ff513f788e2f8964c2db9d58a2e3c9.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral5
Sample
1c3e4e7076555c18f18979886a97c9b7.exe
Resource
win7-20231020-en
Behavioral task
behavioral6
Sample
1c3e4e7076555c18f18979886a97c9b7.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral7
Sample
1ca15ecf5fd4db700d6d79fa27158af2.exe
Resource
win7-20231020-en
Behavioral task
behavioral8
Sample
1ca15ecf5fd4db700d6d79fa27158af2.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral9
Sample
1dbdabb187122382be3684f1fad785e4.exe
Resource
win7-20231023-en
Behavioral task
behavioral10
Sample
1dbdabb187122382be3684f1fad785e4.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral11
Sample
2a96ad5bd97559ac5e7f567c29fbe10c.exe
Resource
win7-20231023-en
Behavioral task
behavioral12
Sample
2a96ad5bd97559ac5e7f567c29fbe10c.exe
Resource
win10v2004-20231025-en
Behavioral task
behavioral13
Sample
2dd39b1e465a3f10c68e8308be15828e.exe
Resource
win7-20231023-en
Behavioral task
behavioral14
Sample
2dd39b1e465a3f10c68e8308be15828e.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral15
Sample
2de6d052aa9607f10149d61832283ada.exe
Resource
win7-20231023-en
Behavioral task
behavioral16
Sample
2de6d052aa9607f10149d61832283ada.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral17
Sample
3b7263328ba5e8f1718522f24a8e52b4.exe
Resource
win7-20231025-en
Behavioral task
behavioral18
Sample
3b7263328ba5e8f1718522f24a8e52b4.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral19
Sample
3b9e7f32560a5918eb5ecd15139520ec.exe
Resource
win7-20231020-en
Behavioral task
behavioral20
Sample
3b9e7f32560a5918eb5ecd15139520ec.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral21
Sample
3c5b4bb566951504af528ce9121759df.exe
Resource
win7-20231020-en
Behavioral task
behavioral22
Sample
3c5b4bb566951504af528ce9121759df.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral23
Sample
3cf4b6aa2b62152a350831922b7fdbac.exe
Resource
win7-20231023-en
Behavioral task
behavioral24
Sample
3cf4b6aa2b62152a350831922b7fdbac.exe
Resource
win10v2004-20231023-en
General
-
Target
007.zip
-
Size
7.0MB
-
MD5
ce03f548c6374b6079f762038f834164
-
SHA1
467c02539ecfb0da0a490ca043f7ed239a9a4f6e
-
SHA256
f9b07372d688c903dae658bd9d723cc87388f1df88d4ff4f29a19fe04930a8b1
-
SHA512
ba11421efedc527e998b65090a7f044bf6c2ea3d24ca14e366b764c2fd1f231e7a6a120164cd900c648a4d5689fa7bfa549ac896181d750a1cd7a86ba8ad3c3c
-
SSDEEP
196608:V15NLUMfhhY9jTsS7mU/Ifl6R4vXfJ8jON8vSy6wBbBw:V1oMphY9H3+4WvXh8jONqSy6wBb6
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
resource yara_rule static1/unpack001/3c5b4bb566951504af528ce9121759df.exe family_zgrat_v1 -
Zgrat family
-
Unsigned PE 12 IoCs
Checks for missing Authenticode signature.
resource unpack001/01c7c94eea4220eca4d8661e32d3cba4.exe unpack001/01ff513f788e2f8964c2db9d58a2e3c9.exe unpack001/1c3e4e7076555c18f18979886a97c9b7.exe unpack001/1ca15ecf5fd4db700d6d79fa27158af2.exe unpack001/1dbdabb187122382be3684f1fad785e4.exe unpack001/2a96ad5bd97559ac5e7f567c29fbe10c.exe unpack001/2dd39b1e465a3f10c68e8308be15828e.exe unpack001/2de6d052aa9607f10149d61832283ada.exe unpack001/3b7263328ba5e8f1718522f24a8e52b4.exe unpack001/3b9e7f32560a5918eb5ecd15139520ec.exe unpack001/3c5b4bb566951504af528ce9121759df.exe unpack001/3cf4b6aa2b62152a350831922b7fdbac.exe
Files
-
007.zip.zip
-
01c7c94eea4220eca4d8661e32d3cba4.exe.exe windows:4 windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 806KB - Virtual size: 806KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
01ff513f788e2f8964c2db9d58a2e3c9.exe.exe windows:4 windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 776KB - Virtual size: 772KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
1c3e4e7076555c18f18979886a97c9b7.exe.exe windows:4 windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 941KB - Virtual size: 941KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
1ca15ecf5fd4db700d6d79fa27158af2.exe.exe windows:4 windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
*@X[om2 Size: 523KB - Virtual size: 522KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 222KB - Virtual size: 221KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 70KB - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
-
1dbdabb187122382be3684f1fad785e4.exe.exe windows:4 windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 371KB - Virtual size: 371KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
2a96ad5bd97559ac5e7f567c29fbe10c.exe.exe windows:4 windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 691KB - Virtual size: 690KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 936B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
2dd39b1e465a3f10c68e8308be15828e.exe.exe windows:4 windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorExeMain
Sections
.text Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
2de6d052aa9607f10149d61832283ada.exe.exe windows:4 windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 845KB - Virtual size: 844KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
3b7263328ba5e8f1718522f24a8e52b4.exe.exe windows:4 windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 812KB - Virtual size: 812KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
3b9e7f32560a5918eb5ecd15139520ec.exe.exe windows:4 windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 774KB - Virtual size: 773KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
3c5b4bb566951504af528ce9121759df.exe.exe windows:4 windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 225KB - Virtual size: 225KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
3cf4b6aa2b62152a350831922b7fdbac.exe.exe windows:4 windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 876KB - Virtual size: 872KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ