General

  • Target
    ama.exe
  • Size 6.1MB
  • Sample240122-e3nqlagfg4
  • SHA256 49128966da54f55e6fd663f8bb8da56e800de17363a33d53e8fc370e29f34e20
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10

Malware Config

Signatures

  • Detect ZGRat V1 1 IoCs
  • Zgrat family

File Explorer

  • ama.exe
    .exe 6.1MB

ama.exe

  • IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
  • SHA256 49128966da54f55e6fd663f8bb8da56e800de17363a33d53e8fc370e29f34e20
  • MD5 SHA1 SHA512 SSDEEP
  • Detect ZGRat V1

PE Signature issue

Digest
88:d6:47:df:ec:7d:96:a1:27:02:15:74:bd:ce:c6:61:db:b6:c5:af:76:be:76:53:6c:d9:ff:a1:3e:5d:04:8d
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
SERIALNUMBER=2286585,CN=MobiSystems\, Inc.,O=MobiSystems\, Inc.,L=San Diego,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a43616c69666f726e6961,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains

Jan 1, 0001

Minor OS version
0
Major OS version
4
Entry point
6286958
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE
PDB paths