Behavioral task
behavioral1
Sample
e065974b0db0079fcc57cf5d209fa267c852772a58a68cee307a72c91d382a8e.exe
Resource
win7-20231129-en
General
-
Target
e065974b0db0079fcc57cf5d209fa267c852772a58a68cee307a72c91d382a8e.exe
-
Size
3.7MB
-
MD5
d3c4575e325d9b2ea4375be6ae184469
-
SHA1
dba82c40924a219234c29c7ab7d6da4e715c8aa2
-
SHA256
e065974b0db0079fcc57cf5d209fa267c852772a58a68cee307a72c91d382a8e
-
SHA512
75d19580269523c1eedbcf3079c6bd15dd4848d212e81028af1a7363927153451b3d579dd5f158df787edd246a9fcc18f7b48d67629e8f120bdd998d6641ef7d
-
SSDEEP
98304:723bBil+7+NRBY2V9sJg2E65NEOzobiP8Xlb46LqpGVP:70BioqNbY2nsJg2E6Npzobi0Xlb462
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
resource yara_rule sample family_zgrat_v1 -
Zgrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e065974b0db0079fcc57cf5d209fa267c852772a58a68cee307a72c91d382a8e.exe
Files
-
e065974b0db0079fcc57cf5d209fa267c852772a58a68cee307a72c91d382a8e.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 3.7MB - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 800B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ