Overview

overview

10

Static

static

10

46E646DCFB...51.exe

windows7-x64

10

46E646DCFB...51.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    46E646DCFB73F26F153653B020F9871DA0DC1BBD39B51.exe

  • Size

    2.3MB

  • Sample

    240112-zpq9safaam

  • MD5

    4496e23ea38964f755d03126a21d4f07

  • SHA1

    63f63f2ce50a5a98e6ba8a0e67671df967e124b0

  • SHA256

    46e646dcfb73f26f153653b020f9871da0dc1bbd39b518e159616e352ebee9fc

  • SHA512

    6ed0bc1abe023f0eebddc7e68adf798842763ea03a6e5083bb571b35f8365def5b2db783612d41abd56966a5af567011d12050787f2472b517a034fa41515b6a

  • SSDEEP

    49152:IBJkS7CosHg6RCq7BK0ufaLN8Wt/FTxbW:yuzPlBAaZNNTlW

Score
10/10
zgratrat

Malware Config

Targets

    • Target

      46E646DCFB73F26F153653B020F9871DA0DC1BBD39B51.exe

    • Size

      2.3MB

    • MD5

      4496e23ea38964f755d03126a21d4f07

    • SHA1

      63f63f2ce50a5a98e6ba8a0e67671df967e124b0

    • SHA256

      46e646dcfb73f26f153653b020f9871da0dc1bbd39b518e159616e352ebee9fc

    • SHA512

      6ed0bc1abe023f0eebddc7e68adf798842763ea03a6e5083bb571b35f8365def5b2db783612d41abd56966a5af567011d12050787f2472b517a034fa41515b6a

    • SSDEEP

      49152:IBJkS7CosHg6RCq7BK0ufaLN8Wt/FTxbW:yuzPlBAaZNNTlW

    Score
    10/10
    zgratrat

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks