zgrat | 24e7e211df3b03f133ec77c4a8a354b7 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

24e7e211df3b03f133ec77c4a8a354b7
Size

1.1MB
MD5

24e7e211df3b03f133ec77c4a8a354b7
SHA1

b5a4b7bbc153c6ed66c6b89b4f77d3206d79967f
SHA256

e93a5343fe05d67854d626418d25ca2773e6aa664e22a4576dbd86b3140866b8
SHA512

2678455d39e0a219a7dad73f770b297bdfdf6f46f66c71afca53804b083eb18918a80978aee0e4c4af4f4df5cb11d489ab75d41935d777e2fa1f2e95905b4f42
SSDEEP

12288:UbvmEGNkEEGNkFPeAr7wOPVCbbcC9P96K3wFvuI49Mmny6LntNP0:MuEGNHEGNkeAr7wMKNZ9PAvr49MqtC

Score

10^/10

zgrat

Malware Config

Signatures

Detect ZGRat V1 1 IoCs

resource	yara_rule
sample	family_zgrat_v1

Zgrat family
zgrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
24e7e211df3b03f133ec77c4a8a354b7

Files

24e7e211df3b03f133ec77c4a8a354b7
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ