Overview

overview

10

Static

static

3

68192cd817...13.exe

windows7-x64

10

68192cd817...13.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    68192cd81726cf9ea4a4187ec0111113

  • Size

    6.5MB

  • Sample

    240119-ty2h8ahfek

  • MD5

    68192cd81726cf9ea4a4187ec0111113

  • SHA1

    46d0eb7842be68a5f625ed927fa6a91715af416b

  • SHA256

    fec4a46308f73f3e49401fa24256a58fdd596f57eee6f29d3336c2b072abda6d

  • SHA512

    bb176584a61b334673e457a1b5c598149ead38785e827d4b2f0348c8f4138a60dceeb9e4a7f7724a50fd32a3440e49e80d97575d091cfb9c991bf8bca576e156

  • SSDEEP

    196608:LoWCHVU8Bi7PPbLAi80f/TiCjPTpPF2bzH0D1:Mz2Pgipr8bQp

Score
10/10
zgratrat

Malware Config

Targets

    • Target

      68192cd81726cf9ea4a4187ec0111113

    • Size

      6.5MB

    • MD5

      68192cd81726cf9ea4a4187ec0111113

    • SHA1

      46d0eb7842be68a5f625ed927fa6a91715af416b

    • SHA256

      fec4a46308f73f3e49401fa24256a58fdd596f57eee6f29d3336c2b072abda6d

    • SHA512

      bb176584a61b334673e457a1b5c598149ead38785e827d4b2f0348c8f4138a60dceeb9e4a7f7724a50fd32a3440e49e80d97575d091cfb9c991bf8bca576e156

    • SSDEEP

      196608:LoWCHVU8Bi7PPbLAi80f/TiCjPTpPF2bzH0D1:Mz2Pgipr8bQp

    Score
    10/10
    zgratrat

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks