Overview

overview

10

Static

static

3

983ffa6d57...30.exe

windows7-x64

10

983ffa6d57...30.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    983ffa6d57f86647306da729613df330

  • Size

    984KB

  • Sample

    240213-cx7keacb52

  • MD5

    983ffa6d57f86647306da729613df330

  • SHA1

    9cbc4aa1b4f5566a7d8a9c508edc7cc96772c1c0

  • SHA256

    4c9a06f79b7bab68122b2d164b63523dceb0205d044c8d230bb758d7fc4729e8

  • SHA512

    90d5b58598e2e8a904363058441956df840cf75389bc8f89b28fe70fd8ef2c7c98c70928ac208002550a127affe57668692d18bc0dd5bdab6f5f2095ebdd6313

  • SSDEEP

    12288:vz+MO8FsF87bhQxUKKKVxe8QuWtajt6iLq17BKGUEsLDw:b+MOQW87bhQxtVUwWa6iLe76Ei

Score
10/10
njratzgratevasionpersistencerattrojan

Malware Config

Targets

    • Target

      983ffa6d57f86647306da729613df330

    • Size

      984KB

    • MD5

      983ffa6d57f86647306da729613df330

    • SHA1

      9cbc4aa1b4f5566a7d8a9c508edc7cc96772c1c0

    • SHA256

      4c9a06f79b7bab68122b2d164b63523dceb0205d044c8d230bb758d7fc4729e8

    • SHA512

      90d5b58598e2e8a904363058441956df840cf75389bc8f89b28fe70fd8ef2c7c98c70928ac208002550a127affe57668692d18bc0dd5bdab6f5f2095ebdd6313

    • SSDEEP

      12288:vz+MO8FsF87bhQxUKKKVxe8QuWtajt6iLq17BKGUEsLDw:b+MOQW87bhQxtVUwWa6iLe76Ei

    Score
    10/10
    zgratpersistenceratnjratevasiontrojan

    • Detect ZGRat V1

    • Modifies WinLogon for persistence

      persistence

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks