Overview

overview

10

Static

static

3

Rwzzrppjj.exe

windows7-x64

10

Rwzzrppjj.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Rwzzrppjj.exe

  • Size

    11KB

  • Sample

    240128-p9p74sbcc5

  • MD5

    31862412ebcd394fe7c8ea8b4816916d

  • SHA1

    8ad999914072b49c37800f0451c821a8adef7e80

  • SHA256

    03ca6d760a5412bb05c911bb49e0a9b1aea7b3290607bf6ad3d64e8507c90423

  • SHA512

    5cafc95a9b50eacaab83002251b0f97683c578873038458ff56001e6a3f8959f3843daa17ee85c610103a78af3e6553016b3e2b5976c535510637d6622517731

  • SSDEEP

    192:JH57ZYw9N3zb26XKlcgh8V2PnHuDrioo:JHpZYcRb26X65SV2vHOrio

Score
10/10
bitratzgratpersistencerattrojan

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

103.153.182.89:1234

Attributes
  • communication_password

    81dc9bdb52d04dc20036dbd8313ed055

  • install_dir

    Install path

  • install_file

    Install name

  • tor_process

    tor

Targets

    • Target

      Rwzzrppjj.exe

    • Size

      11KB

    • MD5

      31862412ebcd394fe7c8ea8b4816916d

    • SHA1

      8ad999914072b49c37800f0451c821a8adef7e80

    • SHA256

      03ca6d760a5412bb05c911bb49e0a9b1aea7b3290607bf6ad3d64e8507c90423

    • SHA512

      5cafc95a9b50eacaab83002251b0f97683c578873038458ff56001e6a3f8959f3843daa17ee85c610103a78af3e6553016b3e2b5976c535510637d6622517731

    • SSDEEP

      192:JH57ZYw9N3zb26XKlcgh8V2PnHuDrioo:JHpZYcRb26X65SV2vHOrio

    Score
    10/10
    bitratzgratpersistencerattrojan

    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

      trojanbitrat

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Drops startup file

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks