General
-
Target
vvv.exe
-
Size
2.9MB
-
MD5
942d0a550e53a6b2ed12211e611003e4
-
SHA1
4b03f3f957caf3f860ce79370ae316fcf5ebacc8
-
SHA256
b23b5ef9032faa46f705749f37759f6f2c8c4c7dbb3925d31decc0fb74b721c4
-
SHA512
767b0f3eafe7b0a0210771a9ec3bf86fa56779a8a5158553afe74ccada8efd57d60b784f6c96eab4ab0fb4a8ef2edc42669e31bf21df015515e949a8b9d9b6df
-
SSDEEP
49152:gNw0zbCOpq5QSk5hMRatYiS+9oVlMF7i32JJLS/AUGlfC5/Sf6mnpf6Ku:gdPCOpq5QqGACJVSBGRx6K
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
resource yara_rule sample family_zgrat_v1 -
Zgrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource vvv.exe
Files
-
vvv.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 58KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ