zgrat | 1ca2b3778c04a5b4160cdfa5f944b4a8 | Triage

Sharing

General

Target

1ca2b3778c04a5b4160cdfa5f944b4a8
Size

8.8MB
MD5

1ca2b3778c04a5b4160cdfa5f944b4a8
SHA1

a9d31911189bd3430cb2895cebd9760f15db1906
SHA256

632c3f62cee7916ddf8bd87460ab14a202d4dd13d38fbbd23deae0208dc1be19
SHA512

19096581f7c2ee1fa74b0fef66740c2638f7de435d554e2f45cfa5f87c01062e0614c12132ebe05a12f190a828e57189b2726e908f3146ad810e0a9b9c97ce63
SSDEEP

196608:uMQc+eFZlGeodgmvZ1GNt4cES5vLlBryyCI4X2/WuHeHrCNSVXN+1Z8fSxMlQeXm:uMQcYGNt4cES5vLlBrnCI4X2/Wu+HrCp

Score

10^/10

zgrat

Malware Config

Signatures

Detect ZGRat V1 1 IoCs

resource	yara_rule
sample	family_zgrat_v1

Zgrat family
zgrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1ca2b3778c04a5b4160cdfa5f944b4a8

Files

1ca2b3778c04a5b4160cdfa5f944b4a8
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 8.7MB - Virtual size: 8.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 109KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ