zgrat | c73b68c96462a0e1edc2041fd95a65d5ad98ac1c79906ef5d736737974cea87a | Triage

Submit
Reports

Overview

overview

Static

static

3

winprofile

windows7-x64

winprofile

windows10-1703-x64

Sharing

Copy URL Twitter E-mail

General

Target

c73b68c96462a0e1edc2041fd95a65d5ad98ac1c79906ef5d736737974cea87a
Size

522KB
Sample

231231-2fz7fahhe5
MD5

b7258e6011dbfc67b96d157d507510be
SHA1

7b5361870a7f58a6352f5a5f6d14297aa39ef377
SHA256

c73b68c96462a0e1edc2041fd95a65d5ad98ac1c79906ef5d736737974cea87a
SHA512

c01eb2a78a188a18e6bd118158a922215d51c0f8eb8db4d800b78c39aeaebf1b2d0dfb8915907ba88c0a85787dac41626406d6f1ccab5d794d42d9be46a6dbc6
SSDEEP

6144:m06j7HKD2eaNKgwl3R+JLSEhxhKkENKLKwHHH9SUnmgcrp+YJHHFaI13hclBn6Bb:0jzKqeUYE/EjNKGuSARYJHTxea6CPTz

Score

10^/10

zgrat discovery rat spyware stealer

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

c73b68c96462a0e1edc2041fd95a65d5ad98ac1c79906ef5d736737974cea87a.exe

Resource

win7-20231215-en

zgrat discovery rat spyware stealer

windows7-x64

12 signatures

300 seconds

Behavioral task

behavioral2

Sample

c73b68c96462a0e1edc2041fd95a65d5ad98ac1c79906ef5d736737974cea87a.exe

Resource

win10-20231215-en

zgrat discovery rat spyware stealer

windows10-1703-x64

8 signatures

300 seconds

Malware Config

Targets

- Target
  
  c73b68c96462a0e1edc2041fd95a65d5ad98ac1c79906ef5d736737974cea87a
- Size
  
  522KB
- MD5
  
  b7258e6011dbfc67b96d157d507510be
- SHA1
  
  7b5361870a7f58a6352f5a5f6d14297aa39ef377
- SHA256
  
  c73b68c96462a0e1edc2041fd95a65d5ad98ac1c79906ef5d736737974cea87a
- SHA512
  
  c01eb2a78a188a18e6bd118158a922215d51c0f8eb8db4d800b78c39aeaebf1b2d0dfb8915907ba88c0a85787dac41626406d6f1ccab5d794d42d9be46a6dbc6
- SSDEEP
  
  6144:m06j7HKD2eaNKgwl3R+JLSEhxhKkENKLKwHHH9SUnmgcrp+YJHHFaI13hclBn6Bb:0jzKqeUYE/EjNKGuSARYJHTxea6CPTz
Score

10^/10

zgrat discovery rat spyware stealer
- Detect ZGRat V1
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

zgratdiscoveryratspywarestealer

behavioral2

zgratdiscoveryratspywarestealer

© 2018-2025

Terms | Privacy