Overview

overview

10

Static

static

10

ca800f43e6...f4.exe

windows7-x64

10

ca800f43e6...f4.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ca800f43e6af0552e09a026eca241ddf56722bafa0af51772f9b6432d9f4caf4.exe

  • Size

    2.0MB

  • Sample

    240213-fxvsdsff37

  • MD5

    70d149f275ccc89790c5405849a9ad9f

  • SHA1

    de1a99c487f1b78320142e64fa1531c65a1ad8e7

  • SHA256

    ca800f43e6af0552e09a026eca241ddf56722bafa0af51772f9b6432d9f4caf4

  • SHA512

    899a53dda2c656117f1e618f06a334557536dcccd28d42a0f2ef6125ff9d0457759cff2c12c96c5b19381e25385ad3e31827f729bd6c5db397a58c0b7b7817a7

  • SSDEEP

    49152:yKB0Z0w15HQDEbwbIx0QEiY/ifrR6Vuo:yKB+1NQDETjAifH

Score
10/10
zgratrat

Malware Config

Targets

    • Target

      ca800f43e6af0552e09a026eca241ddf56722bafa0af51772f9b6432d9f4caf4.exe

    • Size

      2.0MB

    • MD5

      70d149f275ccc89790c5405849a9ad9f

    • SHA1

      de1a99c487f1b78320142e64fa1531c65a1ad8e7

    • SHA256

      ca800f43e6af0552e09a026eca241ddf56722bafa0af51772f9b6432d9f4caf4

    • SHA512

      899a53dda2c656117f1e618f06a334557536dcccd28d42a0f2ef6125ff9d0457759cff2c12c96c5b19381e25385ad3e31827f729bd6c5db397a58c0b7b7817a7

    • SSDEEP

      49152:yKB0Z0w15HQDEbwbIx0QEiY/ifrR6Vuo:yKB+1NQDETjAifH

    Score
    10/10
    zgratrat

    • Detect ZGRat V1

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Detects executables packed with unregistered version of .NET Reactor

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks