zgrat | 88CC26F5D63AF5FCFDC36ACCAE0DB04F[.]exe | Triage

Sharing

General

Target

88CC26F5D63AF5FCFDC36ACCAE0DB04F.exe
Size

20.4MB
MD5

88cc26f5d63af5fcfdc36accae0db04f
SHA1

46d7627f0a00cd378684555e30d7bfbe78687143
SHA256

ee2f4598d9f48283bdd46bb0c9bd70f250a257e89bcfc2fc03275b913230d358
SHA512

3cd33e09524223a1baf882671eacb8033b354a03993c2d2ed7a4ba04796f9b518b5d5b92c93210492f0228bbbb057538bbf23507d10fd8112dce38b359f92cb5
SSDEEP

393216:WDfxovk0AJIh+vncZ9YvMQRVbjUU+5+NBoTRdDzWjWl2xEIYYOoq:WVovkNJIh+vXMwVb3+5+Xo1dva9FYYFq

Score

10^/10

zgrat

Malware Config

Signatures

Detect ZGRat V1 1 IoCs

resource	yara_rule
sample	family_zgrat_v1

Zgrat family
zgrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
88CC26F5D63AF5FCFDC36ACCAE0DB04F.exe

Files

88CC26F5D63AF5FCFDC36ACCAE0DB04F.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 512B - Virtual size: 124B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 770B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 4B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 456B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 20.4MB - Virtual size: 20.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ