Behavioral task
behavioral1
Sample
1exe.exe
Resource
win7-20231129-en
General
-
Target
1exe.exe
-
Size
945KB
-
MD5
ab90ce18fbc91975c1991a65fc044d26
-
SHA1
e408189df66fbaee7f54abe5f42b4ec78bee479b
-
SHA256
8ab1511ae0a9797fd5fc9674c1b1fc9f6cfdf345fe41acf086be367248a59d7f
-
SHA512
41b6025f2d63d28f8b7e5a276c8e58d2a98a7a258bdf123c3ff795aa2a40f1e431ec0b708aaee9739f6e392794d1c9eb6ffaecff0c24ce954a40010b3b8052de
-
SSDEEP
24576:mG0Pcig+HzaD335lgO71mWloEqsATHMn4CGjnSY:mD/GDH5lvhQgA7/cY
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
resource yara_rule sample family_zgrat_v1 -
Zgrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1exe.exe
Files
-
1exe.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 942KB - Virtual size: 942KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ