Overview

overview

10

Static

static

3

9ae50d0f38...94.exe

windows7-x64

10

9ae50d0f38...94.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    3ef515bb081e3a8546a39219bf1310a4.bin

  • Size

    949KB

  • Sample

    240124-b41j1afbhq

  • MD5

    1978802ebe748c5973008f45b0a33967

  • SHA1

    713fef956d9cf43a2dcc5f74fb64e084080a230e

  • SHA256

    5e11cb227ea464ac0b68430d15433e209c8138817f66e6ed4ca51fe0c81fd2c1

  • SHA512

    7a1eae6b5894a47d3548b2f58b9d20a25bbfc80a26b9b911d89d8b2ac7400b258a859d7c347ca78ddaae3c2b93414d50b2af10b506c7f8e8b9424999119574b9

  • SSDEEP

    24576:ASQbbjNRKv6TJ4MhXbOUYk2B222n0iEQuyd2jdwFZwfva:1QPjNRKiV3XtSvrQuyd2jdwvwfC

Score
10/10
zgratpersistencerat

Malware Config

Targets

    • Target

      9ae50d0f38c49c5e2a1e90d5bfa9972e551f8274f83fcf7182ab3ed38b2fd394.exe

    • Size

      971KB

    • MD5

      3ef515bb081e3a8546a39219bf1310a4

    • SHA1

      65b19bc8100f6b67368c46b33d39ef441aaeaeb0

    • SHA256

      9ae50d0f38c49c5e2a1e90d5bfa9972e551f8274f83fcf7182ab3ed38b2fd394

    • SHA512

      22dcac861796e40936f536c3eb908d16fb33b209dcfe5ebd39318bca9134bcdf1504d01ace87b348d6fcfa3cb92f7366d47df1de6f07a64f8b9eaaecf1c2fbd1

    • SSDEEP

      24576:e0iX4h2UdICJKqGHN7zoD+VKUKLCbkfIhtRhp0HBUnhGD:+1UdICQpN4D+vmEhjheHB8h4

    Score
    10/10
    zgratpersistencerat

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks