Overview

overview

10

Static

static

3

559dbd862c...4e.exe

windows7-x64

10

559dbd862c...4e.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    559dbd862cb72a817b0703dae3be1e4e

  • Size

    719KB

  • Sample

    231226-fgk81sgbcl

  • MD5

    559dbd862cb72a817b0703dae3be1e4e

  • SHA1

    cfbf19e56bcbd1fab643e84e23d60e31f6594cbd

  • SHA256

    185d9ef30cb225a144368be10489a25804d2e8759040975059ff9b7eedd26881

  • SHA512

    d500093c426346742c16e01b757e058e33f8bde2cd605ce3683894c1148d3362bb06929745ccf2bf0390ede0c0fedcc7cdd09f540398ec54ef31c87f06e2c47f

  • SSDEEP

    12288:vrq0QzbZQVwvGgM7DdvIXxjdohhfIidc5NE2mydpwcXrKSoFCmk9Km6kDsv:jP2bZQVgG37DdvIwcidc5NE2mydpwcX5

Score
10/10
zgratrat

Malware Config

Targets

    • Target

      559dbd862cb72a817b0703dae3be1e4e

    • Size

      719KB

    • MD5

      559dbd862cb72a817b0703dae3be1e4e

    • SHA1

      cfbf19e56bcbd1fab643e84e23d60e31f6594cbd

    • SHA256

      185d9ef30cb225a144368be10489a25804d2e8759040975059ff9b7eedd26881

    • SHA512

      d500093c426346742c16e01b757e058e33f8bde2cd605ce3683894c1148d3362bb06929745ccf2bf0390ede0c0fedcc7cdd09f540398ec54ef31c87f06e2c47f

    • SSDEEP

      12288:vrq0QzbZQVwvGgM7DdvIXxjdohhfIidc5NE2mydpwcXrKSoFCmk9Km6kDsv:jP2bZQVgG37DdvIwcidc5NE2mydpwcX5

    Score
    10/10
    zgratrat

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • CustAttr .NET packer

      Detects CustAttr .NET packer in memory.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks