Behavioral task
behavioral1
Sample
d70031e215414598a07ffc9ad3933e9ec06996f1197b006a926ba9f45b84e46a.exe
Resource
win7-20231020-en
General
-
Target
d70031e215414598a07ffc9ad3933e9ec06996f1197b006a926ba9f45b84e46a
-
Size
705KB
-
MD5
f369c35ad0c6fe6b06b8a8fd2014e95e
-
SHA1
3b8abd148efa6420dd5af0f1b70fe7752b86b558
-
SHA256
d70031e215414598a07ffc9ad3933e9ec06996f1197b006a926ba9f45b84e46a
-
SHA512
b09482a59e24418c2e276b75c1120fdf1e88e3f4865b5dd905a8266dbfc77d41758bdf0846224c1106715790e881ba8214a700c6b130a1a48e68087648ea497c
-
SSDEEP
12288:DkuNBgY7CSncoXX4A+Us3samUKGNLbuQZDI7pzyu9pcixdafSjxpiRwb:DkwxncQ4rFmPGNLKic7p2HZSlYR
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
resource yara_rule sample family_zgrat_v1 -
Zgrat family
-
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule sample net_reactor -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d70031e215414598a07ffc9ad3933e9ec06996f1197b006a926ba9f45b84e46a
Files
-
d70031e215414598a07ffc9ad3933e9ec06996f1197b006a926ba9f45b84e46a.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 699KB - Virtual size: 699KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ