Behavioral task
behavioral1
Sample
fd8a4f2b56f11fff594f526267468645.exe
Resource
win7-20231215-en
General
-
Target
fd8a4f2b56f11fff594f526267468645.exe
-
Size
342KB
-
MD5
fd8a4f2b56f11fff594f526267468645
-
SHA1
90eb7d49e871f7bd92203ac58ecdd589471918c0
-
SHA256
4c7690aae75b181a414129672bbad75d30883ac9f59ccede66b3b5789bd105b6
-
SHA512
02391ad191eff39fce691b3b02464cdffb01cf084bac29487dbe9f341adb862cb28fa1accce32513898f82a9c89186abd7f92865ef3f9999b57b668a083d0d79
-
SSDEEP
3072:+xnmkwesFA+1e8yDdv9Dv8O+6pcZ0Csem/t/umYOEY2qsCD5UgmmdpPjlnyl/Knt:+xnmXFA+Qx8AumuY2qPDmabjdSKngdU
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
resource yara_rule sample family_zgrat_v1 -
Zgrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fd8a4f2b56f11fff594f526267468645.exe
Files
-
fd8a4f2b56f11fff594f526267468645.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 222KB - Virtual size: 221KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 119KB - Virtual size: 119KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ