Overview

overview

10

Static

static

3

aa913188cb...be.exe

windows7-x64

10

aa913188cb...be.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    aa913188cbf14c18b50a9b546525fcbe

  • Size

    8.4MB

  • Sample

    240228-a2edbafc61

  • MD5

    aa913188cbf14c18b50a9b546525fcbe

  • SHA1

    a4c7a4b090f013800cfe39a69312e78bba6814ee

  • SHA256

    8cd6382a91cf1f0d691f54178ec66897f69f2091f0f0d9ad6afd68951bffd271

  • SHA512

    eb3926392c3c650703a63f1aefc7a163cd7c6c0b126da311bc20f105f98dcc0287a48b6c65de505003f836b26a15c7b81d71eaad3b10188c112f39df1ed99d5a

  • SSDEEP

    196608:0jXi07LQczcygmpv4yrw15L33NohvUz/F9XriPdWRcADG98vEPsSUwaeoNOpmW8l:0jSSccW91B3uhUz/F9X+PAb69MfS9U

Score
10/10
zgratevasionpersistencerat

Malware Config

Targets

    • Target

      aa913188cbf14c18b50a9b546525fcbe

    • Size

      8.4MB

    • MD5

      aa913188cbf14c18b50a9b546525fcbe

    • SHA1

      a4c7a4b090f013800cfe39a69312e78bba6814ee

    • SHA256

      8cd6382a91cf1f0d691f54178ec66897f69f2091f0f0d9ad6afd68951bffd271

    • SHA512

      eb3926392c3c650703a63f1aefc7a163cd7c6c0b126da311bc20f105f98dcc0287a48b6c65de505003f836b26a15c7b81d71eaad3b10188c112f39df1ed99d5a

    • SSDEEP

      196608:0jXi07LQczcygmpv4yrw15L33NohvUz/F9XriPdWRcADG98vEPsSUwaeoNOpmW8l:0jSSccW91B3uhUz/F9X+PAb69MfS9U

    Score
    10/10
    zgratevasionpersistencerat

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Disables Task Manager via registry modification

      evasion

    • Modifies Windows Firewall

      evasion

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks