zgrat | f9bba030acc9b42097c6234f057dd6de1397c86828db4539e3d689f96cf77634 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f9bba030acc9b42097c6234f057dd6de1397c86828db4539e3d689f96cf77634
Size

318KB
MD5

27a8e829b36c4e7914093b631a9e12cd
SHA1

ee7f1a6b5dc7a50427350f22acb1e78cbc24e43e
SHA256

f9bba030acc9b42097c6234f057dd6de1397c86828db4539e3d689f96cf77634
SHA512

b795762c4943f1bb52bdc41cf261710799089e24f43fa2a251d607a900d68a4f881ce94254713f3dfc658681e739fa67123c37afc3a47e2625b253f6a95ee8f9
SSDEEP

3072:W4qJ5Nx0tboDMv3fzTk3yDP1rg7tWrvqEQCluSc2ZrG/9BYSv:W4qJ5Nx0tboIvvzoCj1U7yv8ClqDt

Score

10^/10

zgrat agenttesla

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mymobileorder.com
Port:
587
Username:
[email protected]
Password:
Grace@2023@121
Email To:
[email protected]

Signatures

Agenttesla family
agenttesla

Detect ZGRat V1 1 IoCs

resource	yara_rule
sample	family_zgrat_v1

Zgrat family
zgrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f9bba030acc9b42097c6234f057dd6de1397c86828db4539e3d689f96cf77634

Files

f9bba030acc9b42097c6234f057dd6de1397c86828db4539e3d689f96cf77634
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 316KB - Virtual size: 315KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ