Behavioral task
behavioral1
Sample
BT.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
BT.dll
Resource
win10v2004-20231215-en
General
-
Target
a622e3034b2192eac6cca254eff09434de07b31fc12e13c267692fe8f54ec9e7.zip
-
Size
111KB
-
MD5
1e016003728022d2c832dc91b4e1652a
-
SHA1
83a7b5837549506cde79372712d429078269c8b1
-
SHA256
a622e3034b2192eac6cca254eff09434de07b31fc12e13c267692fe8f54ec9e7
-
SHA512
dbf7646b9d36f3547a44a9bd0cbc4dba7c93a571383a047e9c4ca404f72ad7d7d43f9e3bee320464c794f14f8f5350401bb027c8b25f99816c3fca2948517328
-
SSDEEP
3072:uHSQ9mLxybzI1t3ZMzqR2ypSKuU6G1nRHiL+q7oN+QJ:uHSQ9ixybzIH3uzqR2+uM1gLl7q+QJ
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
resource yara_rule static1/unpack001/BT.dll family_zgrat_v1 -
Zgrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/BT.dll
Files
-
a622e3034b2192eac6cca254eff09434de07b31fc12e13c267692fe8f54ec9e7.zip.zip
-
BT.dll.dll windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Sections
.text Size: 255KB - Virtual size: 254KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 836B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ