Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

0874096005...14.exe

windows7-x64

10

0874096005...14.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    08740960051185e079e88d77f1f416e05fb944a345863ce9182316dc3c0aab14.exe

  • Size

    1.9MB

  • Sample

    240213-da27vace9x

  • MD5

    14f6f2650e4115f846437a021780ad79

  • SHA1

    11825457804c1aec20dfb7049bc9d21e409e8094

  • SHA256

    08740960051185e079e88d77f1f416e05fb944a345863ce9182316dc3c0aab14

  • SHA512

    97b6237d078fde08a90dfd6d30f6196c17bf1b5ed02e5114d51fd0800e77dea5a27868dcea011347f79b6d19c3dd854fa8de118cedb61708d5e124e6e337ebf8

  • SSDEEP

    24576:2TbBv5rUyXVHz9DD003FvrxyYsw14gO8clrAVwMsxeCXEaSmzFN4DKIaUfReHUBr:IBJTBn1UrAVslhPFN6mcMUB+OZwfu5Xl

Score
10/10
zgratevasionrat

Malware Config

Targets

    • Target

      08740960051185e079e88d77f1f416e05fb944a345863ce9182316dc3c0aab14.exe

    • Size

      1.9MB

    • MD5

      14f6f2650e4115f846437a021780ad79

    • SHA1

      11825457804c1aec20dfb7049bc9d21e409e8094

    • SHA256

      08740960051185e079e88d77f1f416e05fb944a345863ce9182316dc3c0aab14

    • SHA512

      97b6237d078fde08a90dfd6d30f6196c17bf1b5ed02e5114d51fd0800e77dea5a27868dcea011347f79b6d19c3dd854fa8de118cedb61708d5e124e6e337ebf8

    • SSDEEP

      24576:2TbBv5rUyXVHz9DD003FvrxyYsw14gO8clrAVwMsxeCXEaSmzFN4DKIaUfReHUBr:IBJTBn1UrAVslhPFN6mcMUB+OZwfu5Xl

    Score
    10/10
    zgratevasionrat

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Detects executables packed with unregistered version of .NET Reactor

    • Disables Task Manager via registry modification

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks