Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20231023-en
General
-
Target
file.exe
-
Size
3.3MB
-
MD5
73bf50ef38ecadff4e120a31ad00c747
-
SHA1
295d4c63e6e06f332abc9bcd63fdc791a28106f3
-
SHA256
64cf760478ae702e8157d46821cfdb8fad6ac6bf640b511ca736d7315db70632
-
SHA512
bd3cd4b759984052a35e37fc5be326f7881eb5258a7e1e8eb73f19e4b6bb620189d81826df5575c7b2e54deaab77c1a0c96989e4e5171aeec5d6b4ef8108cb05
-
SSDEEP
49152:srtlvkg7SLN0vG1YThBRon856UwdeOJe+x0FkCJY7gmpYRt77M9oRSAS/t0IcZID:sr6VChQV+FYf
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
resource yara_rule sample family_zgrat_v1 -
Zgrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource file.exe
Files
-
file.exe.exe windows:4 windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 3.2MB - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 97KB - Virtual size: 97KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ