Overview

overview

10

Static

static

10

NEAS.0c677...f0.exe

windows7-x64

10

NEAS.0c677...f0.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    NEAS.0c6771c5ab6590fd8496e128eb503bf0.exe

  • Size

    635KB

  • Sample

    231117-yyrq8sdf33

  • MD5

    0c6771c5ab6590fd8496e128eb503bf0

  • SHA1

    5e3f64ac9cf1267b80c30ddfc8f69b97fbb41544

  • SHA256

    69ca2d0f5723ab2e94ef62e8bb9d734fe9b4a10415360bc02c3763921af45f37

  • SHA512

    adf5426ce2b55d8507db4601cd15e4721f24f9df9b5633de32d5a2bc070b74789946c3240238d65bed4b074d4e4bd12891c6fc0c74a0d9c7035f88820bf0e341

  • SSDEEP

    12288:TJVt1918SuzpvriS0bhWTL6TpwU4AuwTT9LRPpE0mWvLEFjFlSI6M/sbynr:TJVvwzpM0TwrFpE0TvoFjF0NM/se

Score
10/10
zgratevasionpersistenceratspywarestealer

Malware Config

Targets

    • Target

      NEAS.0c6771c5ab6590fd8496e128eb503bf0.exe

    • Size

      635KB

    • MD5

      0c6771c5ab6590fd8496e128eb503bf0

    • SHA1

      5e3f64ac9cf1267b80c30ddfc8f69b97fbb41544

    • SHA256

      69ca2d0f5723ab2e94ef62e8bb9d734fe9b4a10415360bc02c3763921af45f37

    • SHA512

      adf5426ce2b55d8507db4601cd15e4721f24f9df9b5633de32d5a2bc070b74789946c3240238d65bed4b074d4e4bd12891c6fc0c74a0d9c7035f88820bf0e341

    • SSDEEP

      12288:TJVt1918SuzpvriS0bhWTL6TpwU4AuwTT9LRPpE0mWvLEFjFlSI6M/sbynr:TJVvwzpM0TwrFpE0TvoFjF0NM/se

    Score
    10/10
    zgratevasionpersistenceratspywarestealer

    • Detect ZGRat V1

    • Modifies visibility of file extensions in Explorer

      evasion

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks