Overview

overview

10

Static

static

10

78a0343b36...ce.exe

windows7-x64

10

78a0343b36...ce.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    78a0343b36930749e066ca0bf9a171b338fd00e9dbe3d6e364e06eb4e78cf0ce.exe

  • Size

    1.8MB

  • Sample

    240212-c37glaba87

  • MD5

    afa014338532a8f730aa8e6b5ca09874

  • SHA1

    0a55224d9cf55e5ab12087a8af15612d75753d33

  • SHA256

    78a0343b36930749e066ca0bf9a171b338fd00e9dbe3d6e364e06eb4e78cf0ce

  • SHA512

    5c947b9342d83147633c0956d3af8453b7d6390c78836c810d13d60fe30528d2a74720430104503650ab1ba426cae8554ddd10e002f32d83855b220eb4ac881f

  • SSDEEP

    24576:XZkERkn0rQKC/L5ZQk/Pv6mD6JtkOW4l2f1yz+dGP4hSjdirHEbxn4uYRtqMSZ8I:XZbRk0wXPvp0kNxdCgkdi4tnYnJI

Score
10/10
zgratratspywarestealer

Malware Config

Targets

    • Target

      78a0343b36930749e066ca0bf9a171b338fd00e9dbe3d6e364e06eb4e78cf0ce.exe

    • Size

      1.8MB

    • MD5

      afa014338532a8f730aa8e6b5ca09874

    • SHA1

      0a55224d9cf55e5ab12087a8af15612d75753d33

    • SHA256

      78a0343b36930749e066ca0bf9a171b338fd00e9dbe3d6e364e06eb4e78cf0ce

    • SHA512

      5c947b9342d83147633c0956d3af8453b7d6390c78836c810d13d60fe30528d2a74720430104503650ab1ba426cae8554ddd10e002f32d83855b220eb4ac881f

    • SSDEEP

      24576:XZkERkn0rQKC/L5ZQk/Pv6mD6JtkOW4l2f1yz+dGP4hSjdirHEbxn4uYRtqMSZ8I:XZbRk0wXPvp0kNxdCgkdi4tnYnJI

    Score
    10/10
    zgratratspywarestealer

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Detects executables packed with unregistered version of .NET Reactor

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks