Overview

overview

10

Static

static

3

0c687590cc...16.exe

windows7-x64

10

0c687590cc...16.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0c687590ccdb4b84dbda93c095929416

  • Size

    1.3MB

  • Sample

    231230-dj1elsbcf2

  • MD5

    0c687590ccdb4b84dbda93c095929416

  • SHA1

    2c3458ebee515c5ed39cebdd88eca31991269997

  • SHA256

    5a6768b9584d3709905a295a14a373fd5b9bfce7ca58111592cb5f28674c995e

  • SHA512

    143d302b3481989f81e768cc65ce28b5be38c9066ea7fefe6c8681245ca302ec48d37e5882c62379420aa1c17bb7e11259a061eeb4ddfb7ec263a1b06530c44e

  • SSDEEP

    24576:yVe9P57YARBbofjMw3KsQAxlXZjGfSoH5f:yVIB7VlotXEf1HV

Score
10/10
webmonitorzgratbackdoorinfostealerratupx

Malware Config

Targets

    • Target

      0c687590ccdb4b84dbda93c095929416

    • Size

      1.3MB

    • MD5

      0c687590ccdb4b84dbda93c095929416

    • SHA1

      2c3458ebee515c5ed39cebdd88eca31991269997

    • SHA256

      5a6768b9584d3709905a295a14a373fd5b9bfce7ca58111592cb5f28674c995e

    • SHA512

      143d302b3481989f81e768cc65ce28b5be38c9066ea7fefe6c8681245ca302ec48d37e5882c62379420aa1c17bb7e11259a061eeb4ddfb7ec263a1b06530c44e

    • SSDEEP

      24576:yVe9P57YARBbofjMw3KsQAxlXZjGfSoH5f:yVIB7VlotXEf1HV

    Score
    10/10
    zgratratwebmonitorbackdoorinfostealerupx

    • Detect ZGRat V1

    • RevcodeRat, WebMonitorRat

      WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.

      backdoorratinfostealerwebmonitor

    • WebMonitor payload

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks