Overview

overview

10

Static

static

10

3b9330b099...6b.exe

windows7-x64

10

3b9330b099...6b.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    3b9330b09929cc5391a31e5780a967d26f21b010b586b.exe

  • Size

    3.9MB

  • Sample

    240222-1jqxhafh24

  • MD5

    c93eb1803d22b1ea86a0e5b4c61ab5fc

  • SHA1

    e1be31f724ba662e5067767f6144a3ce64167897

  • SHA256

    3b9330b09929cc5391a31e5780a967d26f21b010b586b2226e3d22038226f800

  • SHA512

    f2509c0e58064a517708e2cadee34805cf3d25043af41f70a34af69b6acfd74b09f1c0c2dc851128f2777e2e49bd9766c719c0f1f8bcf52d325bff54dcce08e1

  • SSDEEP

    98304:yOYX6sYD1rXzznYLGRk3/ZuPqInTeNlZD6jdKkb8p:Fkdq1rIH3/OnaJuy

Score
10/10
zgratratspywarestealer

Malware Config

Targets

    • Target

      3b9330b09929cc5391a31e5780a967d26f21b010b586b.exe

    • Size

      3.9MB

    • MD5

      c93eb1803d22b1ea86a0e5b4c61ab5fc

    • SHA1

      e1be31f724ba662e5067767f6144a3ce64167897

    • SHA256

      3b9330b09929cc5391a31e5780a967d26f21b010b586b2226e3d22038226f800

    • SHA512

      f2509c0e58064a517708e2cadee34805cf3d25043af41f70a34af69b6acfd74b09f1c0c2dc851128f2777e2e49bd9766c719c0f1f8bcf52d325bff54dcce08e1

    • SSDEEP

      98304:yOYX6sYD1rXzznYLGRk3/ZuPqInTeNlZD6jdKkb8p:Fkdq1rIH3/OnaJuy

    Score
    10/10
    zgratratspywarestealer

    • Detect ZGRat V1

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks