Behavioral task
behavioral1
Sample
1be41b26c1da90c44765a5ed06b801ca.exe
Resource
win7-20231201-en
Behavioral task
behavioral2
Sample
1be41b26c1da90c44765a5ed06b801ca.exe
Resource
win10v2004-20231201-en
General
-
Target
1be41b26c1da90c44765a5ed06b801ca
-
Size
4.0MB
-
MD5
1be41b26c1da90c44765a5ed06b801ca
-
SHA1
6bd0d05fd725a0c5eac94e0ee2e79d921672750a
-
SHA256
8671438c113ea09e101a62470ecf0d3a3506f6d6c8aba0998bb863b7c1bf7203
-
SHA512
ab66d5f4e6fc531aa5ac7052cc34c18b43a276318009ffeb4db113e509a00860207ddcac66ce21bb30d664d3733aba4036480b9066f66c1992d46318a33cb8c0
-
SSDEEP
98304:XEqC4AbGSpg0Kz9H7EDIllEvP1pl/QpG64K70CyI:/Cbk0KB7EuEVptV808
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
resource yara_rule sample family_zgrat_v1 -
Zgrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1be41b26c1da90c44765a5ed06b801ca
Files
-
1be41b26c1da90c44765a5ed06b801ca.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 4.0MB - Virtual size: 4.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ