historical_significance_and_installation_files.pdb
Behavioral task
behavioral1
Sample
2024-01-27_635a9dc529daca2b85db20a6bcc27cfc_krakencryptor.exe
Resource
win7-20231215-en
General
-
Target
2024-01-27_635a9dc529daca2b85db20a6bcc27cfc_krakencryptor
-
Size
4.7MB
-
MD5
635a9dc529daca2b85db20a6bcc27cfc
-
SHA1
c1a0a83a7c869c8e3699175f1854a08d08328779
-
SHA256
3486a7a7897c913313d96a89cde87f98f5b076237dcca19eabfb592b68f9e6a8
-
SHA512
8c8715381bbb432aa1a4ba7c6e99ea738f71e5e05224c404526170dfb9c7454fe8d174ed774d214fa10c882b275e8b316f294d05032e0415befb2d8ea16f477a
-
SSDEEP
98304:YcPr/Mcoa2RFgN1ozl3JEbqwSFsr+kJ/+:Fr0c0gO3JgRm0G
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
resource yara_rule sample family_zgrat_v1 -
Detects executables packed with unregistered version of .NET Reactor 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_DotNetReactor -
Zgrat family
-
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule sample net_reactor -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-01-27_635a9dc529daca2b85db20a6bcc27cfc_krakencryptor
Files
-
2024-01-27_635a9dc529daca2b85db20a6bcc27cfc_krakencryptor.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 4.6MB - Virtual size: 4.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 88KB - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ