Overview

overview

10

Static

static

3

ccfb1b9703...68.exe

windows7-x64

10

ccfb1b9703...68.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe

  • Size

    2.2MB

  • Sample

    240213-f1c2raga68

  • MD5

    7dffee2932057f4ab49f2fb16fc19800

  • SHA1

    f0c4d840fcbb6c7f44d496f4c04bfc8ba88a0b1e

  • SHA256

    ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068

  • SHA512

    cffc028320cef6cefd52cc1260ae1210edafe2fed1873160e8812fd87ecaaf7183c0d0b7c8142704803de5acf9d49b18d58ccb51e1fcc0238f8bf2ee36a9c410

  • SSDEEP

    24576:DfY0lWREGo9z03OivlvI4so5YSY/aQlVqbN5pZMUqJzHKUuRZIhLvHN7oX//j5kp:jbvFZsm18YSYRgrqUqwZIfoX//j5k5h

Score
10/10
zgratcollectionratspywarestealer

Malware Config

Targets

    • Target

      ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068.exe

    • Size

      2.2MB

    • MD5

      7dffee2932057f4ab49f2fb16fc19800

    • SHA1

      f0c4d840fcbb6c7f44d496f4c04bfc8ba88a0b1e

    • SHA256

      ccfb1b97034d2b697c953a4447b4226e83cd421487f10dc7facc56e630833068

    • SHA512

      cffc028320cef6cefd52cc1260ae1210edafe2fed1873160e8812fd87ecaaf7183c0d0b7c8142704803de5acf9d49b18d58ccb51e1fcc0238f8bf2ee36a9c410

    • SSDEEP

      24576:DfY0lWREGo9z03OivlvI4so5YSY/aQlVqbN5pZMUqJzHKUuRZIhLvHN7oX//j5kp:jbvFZsm18YSYRgrqUqwZIfoX//j5k5h

    Score
    10/10
    zgratcollectionratspywarestealer

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks