Overview

overview

10

Static

static

3

New order.exe

windows7-x64

10

New order.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    New order.exe

  • Size

    2.7MB

  • Sample

    240105-nv5tksagek

  • MD5

    223a5478aa62bccf577bbe240cdd47d6

  • SHA1

    16c678d0837a434783e5d1e6194c5b3d29f2b044

  • SHA256

    f49a368529fcc6e6e9f1bc66b6254bda180d5d80189859d10116c9e5719eba1c

  • SHA512

    96244200041ccf3758d1b0389c8f8738973637cfa79835cadd6ba649b4949e194d7b1a61e9449a9c62bf1915d64db5da609c6cc67d34dc817c3e557d638ebabf

  • SSDEEP

    49152:4pUqG1bx+C/DJLTmxwM0SWUBHtsRnKTzKGold49d:4C/NmDvT8aclm9

Score
10/10
zgratpersistencerat

Malware Config

Targets

    • Target

      New order.exe

    • Size

      2.7MB

    • MD5

      223a5478aa62bccf577bbe240cdd47d6

    • SHA1

      16c678d0837a434783e5d1e6194c5b3d29f2b044

    • SHA256

      f49a368529fcc6e6e9f1bc66b6254bda180d5d80189859d10116c9e5719eba1c

    • SHA512

      96244200041ccf3758d1b0389c8f8738973637cfa79835cadd6ba649b4949e194d7b1a61e9449a9c62bf1915d64db5da609c6cc67d34dc817c3e557d638ebabf

    • SSDEEP

      49152:4pUqG1bx+C/DJLTmxwM0SWUBHtsRnKTzKGold49d:4C/NmDvT8aclm9

    Score
    10/10
    zgratpersistencerat

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks