zgrat | 0c4bb973e88e0b22652b833aa25f9aae[.]bin

General

Target
0c4bb973e88e0b22652b833aa25f9aae.bin
Size 2.8MB
Sample240108-bd9pzshdfl
SHA256 a75172ac4c7c3489156ce62a882bd9fa634b0a3e1204f10d3c19550cd6baf636
MD5 82058e54aea90b4f514f374ddb9fa41f
SHA1 141d5e25990296a222c82672e63513814d12d338
SHA512 f9b0220fb88c24f0de9893bf89301bc524306124547544c1e86fc7d1c341e02df3724c0de45773e0e21f68b7e92f29bf425d7df9b825baeb421f8b3409f4c834
SSDEEP 49152:F9T78RBWtEd8PxHT/n4XjnJQGxk0Nf2fnpYLTmDLppNj9dj21w6dfaMxR1tHEZGO:FxaWtEdKxHT/n4jJtNePWLUfZ7KldSIu
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

zgrat

Malware Config

Signatures

Detect ZGRat V1 1 IoCs

resource	yara_rule
static1/unpack001/7b3c1e60932c652fc591de285279cbdfb7292b54899842ea5c627fedc7cee8ab.exe	family_zgrat_v1

Zgrat family
zgrat

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
static1/unpack001/7b3c1e60932c652fc591de285279cbdfb7292b54899842ea5c627fedc7cee8ab.exe	net_reactor

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/7b3c1e60932c652fc591de285279cbdfb7292b54899842ea5c627fedc7cee8ab.exe

File Explorer

0c4bb973e88e0b22652b833aa25f9aae.bin

.zip 2.8MB
7b3c1e60932c652fc591de285279cbdfb7292b54899842ea5c627fedc7cee8ab.exe

.exe 5.0MB

0c4bb973e88e0b22652b833aa25f9aae.bin

SHA256 a75172ac4c7c3489156ce62a882bd9fa634b0a3e1204f10d3c19550cd6baf636
MD5 82058e54aea90b4f514f374ddb9fa41f
SHA1 141d5e25990296a222c82672e63513814d12d338
SHA512 f9b0220fb88c24f0de9893bf89301bc524306124547544c1e86fc7d1c341e02df3724c0de45773e0e21f68b7e92f29bf425d7df9b825baeb421f8b3409f4c834
SSDEEP 49152:F9T78RBWtEd8PxHT/n4XjnJQGxk0Nf2fnpYLTmDLppNj9dj21w6dfaMxR1tHEZGO:FxaWtEdKxHT/n4jJtNePWLUfZ7KldSIu
MD5 SHA1 SHA512 SSDEEP

Password

infected

7b3c1e60932c652fc591de285279cbdfb7292b54899842ea5c627fedc7cee8ab.exe

SHA256 7b3c1e60932c652fc591de285279cbdfb7292b54899842ea5c627fedc7cee8ab
MD5 0c4bb973e88e0b22652b833aa25f9aae
SHA1 10227c55b0b07ce05728416fa61a0062a436ade6
SHA512 1dd23305da37c6a78b9c17328152a179f39d37dd0faff857dcd5ee743bf34af98cb7fff96e4e7ba467ef141cacdc82f34c7816b69e7f34c65a276d71a29b9624
SSDEEP 49152:NR7b7Edoz4wYlD2+2cWfGmsQZ0Wf8f8QlWuWzVjnpXGp8mih7NUfXUu4tEqNrqcS:Nye/UUfG/Mul2rq/aReDkizMeQU
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x64 arch:x64

Detect ZGRat V1
.NET Reactor proctector

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Sharing