Behavioral task
behavioral1
Sample
228f0d80a97e4d384bb4696c9a336578.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
228f0d80a97e4d384bb4696c9a336578.exe
Resource
win10v2004-20231222-en
General
-
Target
228f0d80a97e4d384bb4696c9a336578
-
Size
1.4MB
-
MD5
228f0d80a97e4d384bb4696c9a336578
-
SHA1
e81a60c9dc8bc79041b43fc2055f18a82be682b6
-
SHA256
28dbaf8e7b5a823994c2b629a8903f313a7f0cd2f8f2bbf6809bc7bb78a54738
-
SHA512
e0e12b534ea1922d49b0cd69ef502ae784db281c411035ede01fe81e6d2bf75cea30a63e5743ab1f378731bb3ceeafd339a5479c5c7596d96a2eb461a355ba26
-
SSDEEP
24576:5J1YNjZoBeshUsnHV3vj6DGW44FX2QPTKu1sLQ9kNsSJ7bue1Q2Rz8ZiuK6XIgav:NiMJUsHRjIGW44FX2Q7KdnWSdv1Q2CZt
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
resource yara_rule sample family_zgrat_v1 -
Zgrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 228f0d80a97e4d384bb4696c9a336578
Files
-
228f0d80a97e4d384bb4696c9a336578.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ