Behavioral task
behavioral1
Sample
5dcdccafe7de2451a4838fce96713e417ff615bba64106f661296e6a7bf00950.exe
Resource
win7-20231215-en
General
-
Target
5dcdccafe7de2451a4838fce96713e417ff615bba64106f661296e6a7bf00950.exe
-
Size
6.5MB
-
MD5
25a9699ffd172a3f5332ea65aeb60e0d
-
SHA1
965b6041b69b942d01a9e3cd7b9e95926012ce53
-
SHA256
5dcdccafe7de2451a4838fce96713e417ff615bba64106f661296e6a7bf00950
-
SHA512
7ee7795037238021c70586583852bc6b9eb46e9998b33ac7f37000fcf1c6fdc90a22f3ff12e618ce4a6c2a93118f2bd4adaba167fd50e8865f28c5d8ee2719bc
-
SSDEEP
196608:EwcuKdNj8XpAJqDDEC5L/Mul2rVe4iwVUz:EwcLj+AJI4CtlWV1zO
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
resource yara_rule sample family_zgrat_v1 -
Zgrat family
-
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule sample net_reactor -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5dcdccafe7de2451a4838fce96713e417ff615bba64106f661296e6a7bf00950.exe
Files
-
5dcdccafe7de2451a4838fce96713e417ff615bba64106f661296e6a7bf00950.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 6.4MB - Virtual size: 6.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 119KB - Virtual size: 119KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ