Overview

overview

10

Static

static

3

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    b45689d589d6e53943196c4fc67552d465b057d3f76546fb7b11a786e3a388e4

  • Size

    781KB

  • Sample

    240212-fp2wqscf4x

  • MD5

    5502b4463a62be41ece9a4557453fd4d

  • SHA1

    34e9658ce06209b3e594163366efdc997ca89b46

  • SHA256

    b45689d589d6e53943196c4fc67552d465b057d3f76546fb7b11a786e3a388e4

  • SHA512

    d2d4189152a58e98e3409f4e23e23bab07ee13116e2d895b9fe4632bb2477018483d35a3df850155d76b0c627d6b49e6e55edf655abc5650611725a4520eef25

  • SSDEEP

    24576:C0Rs+Qv1cttwIFHosVijOXhQbgkqAoGLdP:trosVijgCb0ANd

Score
10/10
xmrigzgratminerpersistencerat

Malware Config

Targets

    • Target

      b45689d589d6e53943196c4fc67552d465b057d3f76546fb7b11a786e3a388e4

    • Size

      781KB

    • MD5

      5502b4463a62be41ece9a4557453fd4d

    • SHA1

      34e9658ce06209b3e594163366efdc997ca89b46

    • SHA256

      b45689d589d6e53943196c4fc67552d465b057d3f76546fb7b11a786e3a388e4

    • SHA512

      d2d4189152a58e98e3409f4e23e23bab07ee13116e2d895b9fe4632bb2477018483d35a3df850155d76b0c627d6b49e6e55edf655abc5650611725a4520eef25

    • SSDEEP

      24576:C0Rs+Qv1cttwIFHosVijOXhQbgkqAoGLdP:trosVijgCb0ANd

    Score
    10/10
    zgratpersistenceratxmrigminer

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks