Behavioral task
behavioral1
Sample
2af1445920378f3ae07b2a38937bdc492d0ab03b5e898a5bc356bf51b0d594f3.exe
Resource
win7-20231215-en
General
-
Target
2af1445920378f3ae07b2a38937bdc492d0ab03b5e898a5bc356bf51b0d594f3
-
Size
5.6MB
-
MD5
776e35429a8a65b3c13d7cdfa241bca9
-
SHA1
7ff3772b49bc4c8083fa67dc3f0ea829ee33d34e
-
SHA256
2af1445920378f3ae07b2a38937bdc492d0ab03b5e898a5bc356bf51b0d594f3
-
SHA512
c38dff581c7ed3274c000bd24634a2abe08ddba9f469daf92c766e734b11775460c46e7586169b24955cda3d4c3acc85460ea79c7b6170a4186368aa27bc247a
-
SSDEEP
98304:roGRXpfNtNstyG/Mul2rq/aReDkizMeQUL:dRx3ml/Mul2rVe4iwVUL
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
resource yara_rule sample family_zgrat_v1 -
Zgrat family
-
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule sample net_reactor -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2af1445920378f3ae07b2a38937bdc492d0ab03b5e898a5bc356bf51b0d594f3
Files
-
2af1445920378f3ae07b2a38937bdc492d0ab03b5e898a5bc356bf51b0d594f3.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 80KB - Virtual size: 79KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ