cae49b754cd4f40f428eaa78ceeef195.bin
- SHA256 1e56543d09770766eb72db3065d71c07b89127507419263dd4f2f0cf2573dde2
Password
infected
Behavioral task
behavioral1
Sample
493807123c2e449d0dcfdbd3443d083aef30a6aaea42381290572bab06090c0b.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
General
- Target cae49b754cd4f40f428eaa78ceeef195.bin
- Size 3.6MB
- Sample240108-d86b6abee3
- SHA256 1e56543d09770766eb72db3065d71c07b89127507419263dd4f2f0cf2573dde2
- MD5 a401d0ebe91c82f07e16f3080770d10a
- SHA1 5b482aee49c2e2b4889a75533bdcab2f6bed3767
- SHA512 aa5c4208a9c92597c15eedf9653c57c1ce35232aea768402c0bfd3424217176bd57a08510821383e1bddebfd95962f7e887caae2d042ad6c211f8265fcca387f
- SSDEEP 98304:c/y4pR9j0J1/vcnR858rrpG4tuhVOwQsW8Nr:c/y4l21s+qrrEs4VvWWr
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detect ZGRat V1 1 IoCs
resource yara_rule static1/unpack001/493807123c2e449d0dcfdbd3443d083aef30a6aaea42381290572bab06090c0b.exe family_zgrat_v1 - Zgrat family
- .NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule static1/unpack001/493807123c2e449d0dcfdbd3443d083aef30a6aaea42381290572bab06090c0b.exe net_reactor
File Explorer
-
cae49b754cd4f40f428eaa78ceeef195.bin.zip 3.6MB
-
493807123c2e449d0dcfdbd3443d083aef30a6aaea42381290572bab06090c0b.exe.exe 5.1MB
493807123c2e449d0dcfdbd3443d083aef30a6aaea42381290572bab06090c0b.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 493807123c2e449d0dcfdbd3443d083aef30a6aaea42381290572bab06090c0b
- MD5 cae49b754cd4f40f428eaa78ceeef195
- SHA1 c83006a616cef6e50254598ba869f8c1fef03d28
- SHA512 40465396da861b69140139a493c21e8be32a7b5b03631381bbb3a04ea681c4d374a0046a82feda160a3414930af8f8bf460ce43d1a8559be93e6aec2bc315f52
- SSDEEP 98304:Ab+ge5mSVzQzRNWDs4vCS7W5IeouyUKylP1uniL8OspPYB:AbG5dV0dNWI6CS7xnuyUCiL5spPk
- MD5 SHA1 SHA512 SSDEEP
-
Detect ZGRat V1
-
.NET Reactor proctector
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
Password
infected
PE Signature issue
Digest
29:a0:56:b7:45:3c:c9:28:4f:36:0a:8f:ac:91:52:87:26:48:f8:2b:34:ba:13:f9:0f:8c:b6:0c:a6:f4:4a:c4
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=TomTom International B.V.,O=TomTom International B.V.,L=Amsterdam,C=NL
Chains
Jul 18, 2023
CN=TomTom International B.V.,O=TomTom International B.V.,L=Amsterdam,C=NL
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
PE Signature issue
Digest
29:a0:56:b7:45:3c:c9:28:4f:36:0a:8f:ac:91:52:87:26:48:f8:2b:34:ba:13:f9:0f:8c:b6:0c:a6:f4:4a:c4
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=TomTom International B.V.,O=TomTom International B.V.,L=Amsterdam,C=NL
Chains
Jul 18, 2023
CN=TomTom International B.V.,O=TomTom International B.V.,L=Amsterdam,C=NL
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=TomTom International B.V.,O=TomTom International B.V.,L=Amsterdam,C=NL
Serial Number
06:18:bb:51:49:d9:03:35:7d:b0:00:4c:dd:80:4a:7e
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 7, 2023 - Feb 10, 2024
Subject
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
Serial Number
38:63:de:f8
Issuer
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Dec 24, 1999 - Jul 24, 2029
Subject
CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US
Serial Number
58:da:13:ff:00:00:00:00:51:ce:0d:f7
Issuer
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 22, 2015 - Jun 22, 2029
Subject
CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA
Serial Number
56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f
Issuer
CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 4, 2022 - Jan 1, 2029
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=TomTom International B.V.,O=TomTom International B.V.,L=Amsterdam,C=NL
Serial Number
06:18:bb:51:49:d9:03:35:7d:b0:00:4c:dd:80:4a:7e
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 7, 2023 - Feb 10, 2024
Subject
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
Serial Number
38:63:de:f8
Issuer
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Dec 24, 1999 - Jul 24, 2029
Subject
CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US
Serial Number
58:da:13:ff:00:00:00:00:51:ce:0d:f7
Issuer
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 22, 2015 - Jun 22, 2029
Subject
CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA
Serial Number
56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f
Issuer
CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 4, 2022 - Jan 1, 2029
Minor OS version
0
Major OS version
4
Entry point
5144478
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
4.9MB
Virtual Size
4.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
131KB
Virtual Size
131KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ