Overview

overview

10

Static

static

10

5f271e8ff9...b0.exe

windows7-x64

10

5f271e8ff9...b0.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5f271e8ff947d299a9e4030253947bb0.bin

  • Size

    583KB

  • Sample

    231107-cqhmpshh6z

  • MD5

    5f271e8ff947d299a9e4030253947bb0

  • SHA1

    3eed8a29dcf3a738d0070d0cebb4fd5067fce81f

  • SHA256

    d9377879a0ba3659f2aac7fc184ffb74cdb4a3da326421bb4309de34312a7f96

  • SHA512

    44c1d9f108b950bd3a00f422b3cf3fd79756d80e5c165f7d1355f90e4bc8565fc6b40802ee7401a31d45e82c7c1004180d880ffcf213a2e30aafa2365810f18b

  • SSDEEP

    12288:2JVt1918SuzpvriS0bhWTL6TpwU4AuwTT9LRPpE0mWvLEFjFRx:2JVvwzpM0TwrFpE0TvoFjFRx

Score
10/10
zgratevasionpersistenceratspywarestealer

Malware Config

Targets

    • Target

      5f271e8ff947d299a9e4030253947bb0.bin

    • Size

      583KB

    • MD5

      5f271e8ff947d299a9e4030253947bb0

    • SHA1

      3eed8a29dcf3a738d0070d0cebb4fd5067fce81f

    • SHA256

      d9377879a0ba3659f2aac7fc184ffb74cdb4a3da326421bb4309de34312a7f96

    • SHA512

      44c1d9f108b950bd3a00f422b3cf3fd79756d80e5c165f7d1355f90e4bc8565fc6b40802ee7401a31d45e82c7c1004180d880ffcf213a2e30aafa2365810f18b

    • SSDEEP

      12288:2JVt1918SuzpvriS0bhWTL6TpwU4AuwTT9LRPpE0mWvLEFjFRx:2JVvwzpM0TwrFpE0TvoFjFRx

    Score
    10/10
    zgratevasionpersistenceratspywarestealer

    • Detect ZGRat V1

    • Modifies visibility of file extensions in Explorer

      evasion

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks