Behavioral task
behavioral1
Sample
4c329895f6793befe5c8f8f2e2aea5d7.exe
Resource
win7-20231215-en
General
-
Target
4c329895f6793befe5c8f8f2e2aea5d7
-
Size
268KB
-
MD5
4c329895f6793befe5c8f8f2e2aea5d7
-
SHA1
79c17f9fa023c4360be4101da14c456df0e7be78
-
SHA256
5bc5601c01cf0b24b3d3b8494a0702a4ab0e9d819e5e4a545ab6b88c97eb8b54
-
SHA512
9945a641b66b41a655898ec3d02ad94485a21688c8203f65ef0915f51a083dbca59584d985c11b719f6ff1e4946d82976b810c98b25aed6f226f80482688fdd8
-
SSDEEP
6144:S2+NCsVvpbd9aOS31epQ4fo7Pd2t96zgmaZ5Vrrl3b:SNxVd8OAUfo7Pd2t96zgmaZ5Vrrx
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
resource yara_rule sample family_zgrat_v1 -
Zgrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4c329895f6793befe5c8f8f2e2aea5d7
Files
-
4c329895f6793befe5c8f8f2e2aea5d7.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 267KB - Virtual size: 267KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ