Overview

overview

10

Static

static

3

b9ed846963...5c.exe

windows7-x64

10

b9ed846963...5c.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    b9ed84696306d78e044856c1051e185c.exe

  • Size

    1.5MB

  • Sample

    240217-jllbcsdb64

  • MD5

    b9ed84696306d78e044856c1051e185c

  • SHA1

    4f290faab5808fa54bccd39e3db42df60d42351d

  • SHA256

    a8db619c3a1f082794d5b3837c574ea528724ee2e324677362c4f49ef8fb98a3

  • SHA512

    e7b61275c4b4ab99b3a51c9004c712851ec4efc54c3cbe2828ed49aa065254f6710d837850ef9cf1e3fbec3deb3c314d97f6b26ced0bd0419bde4ae0a80cd46f

  • SSDEEP

    24576:2TbBv5rUyXVUgH7jDkPlYGxvxDFvwKY/X7PJbxxqf1++Pq/IrKQL9R5nKKFwkKS5:IBJUgHQuMF43/rw0uq/IdR9K6wC

Score
10/10
zgratratspywarestealer

Malware Config

Targets

    • Target

      b9ed84696306d78e044856c1051e185c.exe

    • Size

      1.5MB

    • MD5

      b9ed84696306d78e044856c1051e185c

    • SHA1

      4f290faab5808fa54bccd39e3db42df60d42351d

    • SHA256

      a8db619c3a1f082794d5b3837c574ea528724ee2e324677362c4f49ef8fb98a3

    • SHA512

      e7b61275c4b4ab99b3a51c9004c712851ec4efc54c3cbe2828ed49aa065254f6710d837850ef9cf1e3fbec3deb3c314d97f6b26ced0bd0419bde4ae0a80cd46f

    • SSDEEP

      24576:2TbBv5rUyXVUgH7jDkPlYGxvxDFvwKY/X7PJbxxqf1++Pq/IrKQL9R5nKKFwkKS5:IBJUgHQuMF43/rw0uq/IdR9K6wC

    Score
    10/10
    zgratratspywarestealer

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks