Overview

overview

10

Static

static

10

25ab561d01...3f.exe

windows7-x64

10

25ab561d01...3f.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    25ab561d014bdd7b50d5fa913d111bcb4dd3e41d22a5850764a7659aece4d33f.exe

  • Size

    13.6MB

  • Sample

    240222-gef2yscf2y

  • MD5

    b0936e93d834360ddfebb650d4035610

  • SHA1

    f94576a242babe98f8f136066cf2fd07559e35ba

  • SHA256

    25ab561d014bdd7b50d5fa913d111bcb4dd3e41d22a5850764a7659aece4d33f

  • SHA512

    708ac11bcf7089212dc2d0aa84d0625006d8dfea92771b8f056c0ac269f778986f2fd923b428273f65e8829c2b9b5fce6eeadc3935e50007184d9f5511d36e6a

  • SSDEEP

    49152:IBJ+66j8SXHRiMggPhX4XJDpo8klHtqDrbwzLRukj9sqZE+v3DEu2m21ql:yU6k8kZbh0VRU0DX642zE+PD32m2gl

Score
10/10
zgratevasionpersistenceratspywarestealer

Malware Config

Targets

    • Target

      25ab561d014bdd7b50d5fa913d111bcb4dd3e41d22a5850764a7659aece4d33f.exe

    • Size

      13.6MB

    • MD5

      b0936e93d834360ddfebb650d4035610

    • SHA1

      f94576a242babe98f8f136066cf2fd07559e35ba

    • SHA256

      25ab561d014bdd7b50d5fa913d111bcb4dd3e41d22a5850764a7659aece4d33f

    • SHA512

      708ac11bcf7089212dc2d0aa84d0625006d8dfea92771b8f056c0ac269f778986f2fd923b428273f65e8829c2b9b5fce6eeadc3935e50007184d9f5511d36e6a

    • SSDEEP

      49152:IBJ+66j8SXHRiMggPhX4XJDpo8klHtqDrbwzLRukj9sqZE+v3DEu2m21ql:yU6k8kZbh0VRU0DX642zE+PD32m2gl

    Score
    10/10
    zgratevasionpersistenceratspywarestealer

    • Detect ZGRat V1

    • Modifies WinLogon for persistence

      persistence

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Detects executables packed with unregistered version of .NET Reactor

    • Disables Task Manager via registry modification

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks