zgrat | LadonExp[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

LadonExp.exe
Size

635KB
MD5

a57ffee940974cf3d65585d341fcfd48
SHA1

b988fdcebe7b8b02bc4b30f55bcac9e34c3b9901
SHA256

423ecb133e53337a8e793bd20e07aebcb4957a86114505cf258c0e8288bb52b5
SHA512

e8031ca7c17348024f519d8a85ca0543948b2d4d2ef1d51f086ef8a5d7ef01136759967be103f6798c758cc5ce6542596bfde95cfb3536b9dcf1d9fc5b08cec6
SSDEEP

6144:WB31E0an+av4SwTilXOJ3+Ax2fAD0K7FRvSw/WqQYY04beqXw/W:WB31da+avoOoI4rz+B846qg+

Score

10^/10

zgrat

Malware Config

Signatures

Detect ZGRat V1 1 IoCs

resource	yara_rule
sample	family_zgrat_v1

Zgrat family
zgrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
LadonExp.exe

Files

LadonExp.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 595KB - Virtual size: 594KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ