General
-
Target
cd18ddaeba5adcbf68717543213bdff30e80f8615d691892dc0ca23fd8954174
-
Size
2.5MB
-
MD5
1818ceefe46f16d7efcb001312e0a616
-
SHA1
72a15b8bdd51801194386cb56801baf7a38d1bcf
-
SHA256
cd18ddaeba5adcbf68717543213bdff30e80f8615d691892dc0ca23fd8954174
-
SHA512
a698b704f66f6dc031a66d0df38b682d38c79c19fcef22d2cc60ec7e1fd2b48ef01fe55afa486f3bcc6f6f43d96c286fce7e54f2b611ce2b86f8165993186117
-
SSDEEP
24576:ktPz7WDyN5V7+ONHrEUuSdYY6JUiaXs4qLTxhpO/3ncC61WYJQ0CCc8BGcVNN7fS:SXVAxhpU3cC61bJQ0CCc88EN7f
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
resource yara_rule sample family_zgrat_v1 -
Zgrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cd18ddaeba5adcbf68717543213bdff30e80f8615d691892dc0ca23fd8954174
Files
-
cd18ddaeba5adcbf68717543213bdff30e80f8615d691892dc0ca23fd8954174.exe windows:4 windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 2.4MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 102KB - Virtual size: 101KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ