zgrat | file[.]exe

General

Target
file.exe
Size 4.4MB
Sample231208-rl6lasbhb6
SHA256 7229c22dfd34e71d0b66b8b8114a5241d34a4a96e231eed3aab50b6ff0dbce26
MD5 dc93f339312e02f8cc7f884b8ab8285e
SHA1 288729c3a0642698b0f83429bd74cbfb0ff5eb50
SHA512 a9745e3ed1af545bbfc84ff91516c228c4098b1465591f402f2d334c6f40e5fd105a23e5e7aaa0b56f2bb6f3848cfd44814433c7ec86446ec1bd3d7d5d6ba87c
SSDEEP 49152:JrawQuFhGtxp8e+OjHezrWmaa5BfdxgSMiUfGr+Cg8yy4ys44AL9+B4ZNzw4CjCz:jUuNzw43zODQX3lBl95+lRNRTcOMUa
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

zgrat

Malware Config

Signatures

Detect ZGRat V1 1 IoCs

resource	yara_rule
sample	family_zgrat_v1

Zgrat family
zgrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 4.4MB

file.exe

SHA256 7229c22dfd34e71d0b66b8b8114a5241d34a4a96e231eed3aab50b6ff0dbce26
MD5 dc93f339312e02f8cc7f884b8ab8285e
SHA1 288729c3a0642698b0f83429bd74cbfb0ff5eb50
SHA512 a9745e3ed1af545bbfc84ff91516c228c4098b1465591f402f2d334c6f40e5fd105a23e5e7aaa0b56f2bb6f3848cfd44814433c7ec86446ec1bd3d7d5d6ba87c
SSDEEP 49152:JrawQuFhGtxp8e+OjHezrWmaa5BfdxgSMiUfGr+Cg8yy4ys44AL9+B4ZNzw4CjCz:jUuNzw43zODQX3lBl95+lRNRTcOMUa
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x64 arch:x64

Detect ZGRat V1
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer

file.exe

generic