zgrat | download[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

download.exe
Size

323KB
MD5

1972629389fc19e005124c9a7f578db1
SHA1

1f2391373ce218ef3d0aa35a36d27464ceaa0d81
SHA256

5f2cef1b54a25cc5e2a57674190edf973c3fad8307ff7199453ee4852db8cc8d
SHA512

e8ea7b874dd7653f9ecb0928b26e3903f8a51e5a1496f669efdf1bb9b50c8681d0d23f95d912afd1d0bbf9da221d14795272ef3a4efefeb5f10e78051e1e8480
SSDEEP

3072:3Pr4LpgC5fKTNdVxakWIF0/jS3axcIJIkD9PldMPNmh0BGN7ckPKw:/vLVxl2/jS3jFk930BMfP

Score

10^/10

zgrat

Malware Config

Signatures

Detect ZGRat V1 1 IoCs

resource	yara_rule
sample	family_zgrat_v1

Zgrat family
zgrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
download.exe

Files

download.exe
.dll windows:4 windows x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 321KB - Virtual size: 320KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 788B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ