Behavioral task
behavioral1
Sample
1e66433493d9aad550a2febe2433bd117129e968b055841c7ae1997369ac0511.exe
Resource
win7-20240221-en
General
-
Target
1e66433493d9aad550a2febe2433bd117129e968b055841c7ae1997369ac0511
-
Size
694KB
-
MD5
9bae6d3afb22e8f8c8aba60f652d55ec
-
SHA1
9d909c53191dad75c84c75067594bd470cf34dac
-
SHA256
1e66433493d9aad550a2febe2433bd117129e968b055841c7ae1997369ac0511
-
SHA512
c664c37247e6a5209581a6be63ced107d98937ba119ca6a2dec2bda9cfb48dea751083f0c4e86026fc9d05c2b5cb76a68375c90095d0491152b695678bccc992
-
SSDEEP
12288:tsQ4ZUXCJVkKs1Xx83mSsFhtFrnQbWWODTDBAYL/u5cvprvhrmYTl39521aV:todVknRxQBsFrFrnjtDT1AYL/Gkprvh3
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
resource yara_rule sample family_zgrat_v1 -
Zgrat family
-
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule sample net_reactor -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1e66433493d9aad550a2febe2433bd117129e968b055841c7ae1997369ac0511
Files
-
1e66433493d9aad550a2febe2433bd117129e968b055841c7ae1997369ac0511.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
E?O[,n&u Size: - Virtual size: 431KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
MjQsvW&k Size: - Virtual size: 162KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Dn*Oxh`R Size: 691KB - Virtual size: 690KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
X)an>gRB Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
R^lJUh<1 Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ