Errors

Reason
expected element type <jnlp> but have <jnlp-file>
Reason
expected element type <jnlp> but have <jnlp-file>
Reason
expected element type <jnlp> but have <jnlp-file>
Reason
expected element type <jnlp> but have <jnlp-file>
Reason
expected element type <jnlp> but have <jnlp-file>
Reason
expected element type <jnlp> but have <jnlp-file>
Reason
expected element type <jnlp> but have <jnlp-fil>
Reason
expected element type <jnlp> but have <jnlp-file>
Reason
expected element type <jnlp> but have <jnlp-file>
Reason
expected element type <jnlp> but have <jnlp-file>

General

  • Target

    executor x64-x23.zip

  • Size

    21.1MB

  • MD5

    f9f78c2be45228af8f238a02a23060cc

  • SHA1

    b245acceefd1abc0cb920bfb77b6a4deebbfaecc

  • SHA256

    c21f14a55785ea00f68c753ed97f00880a331f7f3055bab7257568dbbe9baf91

  • SHA512

    7acdf5deacd3a36947765f9f01769942163f5688df1e9c573630c4bc3e4d9d6dc26cd2dc784e1b7b7fecbca04403ede76f36d5fd8cb5a5cbd78ffe9ef84ec9e9

  • SSDEEP

    393216:csC03oJ7QER+u7gUttG3w5hey2yVHrx/O5S3x9VTyd6f77/jhCke7We:2+U+u7httG3kSgJO5WtyQfHlCkeye

Score
10/10

Malware Config

Signatures

  • Detect ZGRat V1 1 IoCs
  • Zgrat family

Files

  • executor x64-x23.zip
    .zip

    Password: 1313

  • executor x64-x23/executor/louder.exe
    .exe windows:4 windows x86 arch:x86

    Password: 1313

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • executor x64-x23/executor/menu.lua
  • executor x64-x23/executor/scriрts/amd64/cmm/CIEXYZ.pf
  • executor x64-x23/executor/scriрts/amd64/cmm/GRAY.pf
  • executor x64-x23/executor/scriрts/amd64/cmm/LINEAR_RGB.pf
  • executor x64-x23/executor/scriрts/amd64/cmm/PYCC.pf
  • executor x64-x23/executor/scriрts/amd64/cmm/accessibility.properties
  • executor x64-x23/executor/scriрts/amd64/cmm/calendars.properties
  • executor x64-x23/executor/scriрts/amd64/cmm/charsets.jar
    .jar
  • executor x64-x23/executor/scriрts/amd64/cmm/classlist
  • executor x64-x23/executor/scriрts/amd64/cmm/content-types.properties
  • executor x64-x23/executor/scriрts/amd64/cmm/currency.data
  • executor x64-x23/executor/scriрts/amd64/cmm/deploy.jar
    .jar
  • executor x64-x23/executor/scriрts/amd64/cmm/flavormap.properties
  • executor x64-x23/executor/scriрts/amd64/cmm/javaws.jar
    .jar
  • executor x64-x23/executor/scriрts/amd64/cmm/jsse.jar
    .jar
  • executor x64-x23/executor/scriрts/amd64/cmm/plugin.jar
    .jar
  • executor x64-x23/executor/scriрts/amd64/cmm/sRGB.pf
  • executor x64-x23/executor/scriрts/amd64/jvm.cfg
  • executor x64-x23/executor/scriрts/applet/ShadowPlay/NVSPCAPS/_nvspcaps64.dll
    .dll windows:6 windows x64 arch:x64

    Password: 1313

    c27cb76bf211b8bcd4628bb3c785f146


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • executor x64-x23/executor/scriрts/applet/ShadowPlay/NvRemux.dll
    .dll windows:6 windows x86 arch:x86

    Password: 1313

    32239a8689b43baf17eaf1d56db9bedf


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • executor x64-x23/executor/scriрts/applet/ShadowPlay/Plugins/LocalSystem/_nvspserviceplugin64.dll
    .dll .ps1 windows:6 windows x64 arch:x64 polyglot

    Password: 1313

    be4f48d4b1a7e383cbeb76503e3754ad


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • executor x64-x23/executor/scriрts/applet/ShadowPlay/cudart64_55.dll
    .dll windows:5 windows x64 arch:x64

    Password: 1313

    843c192c7d7896462173279e0cd57f3b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • executor x64-x23/executor/scriрts/applet/ShadowPlay/ipccommon64.dll
    .dll windows:6 windows x64 arch:x64

    Password: 1313

    a31bc150fd5eb667acc500380648124a


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • executor x64-x23/executor/scriрts/applet/ShadowPlay/nvspscreenshot64.dll
    .dll windows:6 windows x64 arch:x64

    Password: 1313

    08d773bb983bd578690d34f825b20422


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • executor x64-x23/executor/scriрts/applet/fonts/LucidaBrightDemiBold.ttf
  • executor x64-x23/executor/scriрts/applet/fonts/LucidaBrightDemiItalic.ttf
  • executor x64-x23/executor/scriрts/applet/fonts/LucidaBrightItalic.ttf
  • executor x64-x23/executor/scriрts/applet/fonts/LucidaBrightRegular.ttf
  • executor x64-x23/executor/scriрts/applet/fonts/LucidaSansDemiBold.ttf
  • executor x64-x23/executor/scriрts/applet/fonts/LucidaSansRegular.ttf
  • executor x64-x23/executor/scriрts/applet/fonts/LucidaTypewriterBold.ttf
  • executor x64-x23/executor/scriрts/applet/fonts/LucidaTypewriterRegular.ttf
  • executor x64-x23/executor/scriрts/ext/access-bridge-64.jar
    .jar
  • executor x64-x23/executor/scriрts/ext/cldrdata.jar
    .jar
  • executor x64-x23/executor/scriрts/ext/deploy/ffjcext.zip
    .zip .js polyglot

    Password: 1313

  • {CAFEEFAC-0018-0000-0391-ABCDEFFEDCBA}/chrome.manifest
  • {CAFEEFAC-0018-0000-0391-ABCDEFFEDCBA}/chrome/content/ffjcext/ffjcext.js
    .js
  • {CAFEEFAC-0018-0000-0391-ABCDEFFEDCBA}/chrome/content/ffjcext/ffjcext.xul
    .xml
  • {CAFEEFAC-0018-0000-0391-ABCDEFFEDCBA}/chrome/locale/de-DE/ffjcext/ffjcext.dtd
  • {CAFEEFAC-0018-0000-0391-ABCDEFFEDCBA}/chrome/locale/en-US/ffjcext/ffjcext.dtd
  • {CAFEEFAC-0018-0000-0391-ABCDEFFEDCBA}/chrome/locale/es-ES/ffjcext/ffjcext.dtd
  • {CAFEEFAC-0018-0000-0391-ABCDEFFEDCBA}/chrome/locale/fr-FR/ffjcext/ffjcext.dtd
  • {CAFEEFAC-0018-0000-0391-ABCDEFFEDCBA}/chrome/locale/it-IT/ffjcext/ffjcext.dtd
  • {CAFEEFAC-0018-0000-0391-ABCDEFFEDCBA}/chrome/locale/ja-JP/ffjcext/ffjcext.dtd
  • {CAFEEFAC-0018-0000-0391-ABCDEFFEDCBA}/chrome/locale/ko-KR/ffjcext/ffjcext.dtd
  • {CAFEEFAC-0018-0000-0391-ABCDEFFEDCBA}/chrome/locale/sv-SE/ffjcext/ffjcext.dtd
  • {CAFEEFAC-0018-0000-0391-ABCDEFFEDCBA}/chrome/locale/zh-CN/ffjcext/ffjcext.dtd
  • {CAFEEFAC-0018-0000-0391-ABCDEFFEDCBA}/chrome/locale/zh-TW/ffjcext/ffjcext.dtd
  • {CAFEEFAC-0018-0000-0391-ABCDEFFEDCBA}/install.rdf
    .xml
  • executor x64-x23/executor/scriрts/ext/deploy/fontconfig.bfc
  • executor x64-x23/executor/scriрts/ext/deploy/fontconfig.properties.src
  • executor x64-x23/executor/scriрts/ext/deploy/hijrah-config-umalqura.properties
  • executor x64-x23/executor/scriрts/ext/deploy/javafx.properties
  • executor x64-x23/executor/scriрts/ext/deploy/jce.jar
    .jar
  • executor x64-x23/executor/scriрts/ext/deploy/jfr.jar
    .jar
  • executor x64-x23/executor/scriрts/ext/deploy/jfxswt.jar
    .jar
  • executor x64-x23/executor/scriрts/ext/deploy/jvm.hprof.txt
  • executor x64-x23/executor/scriрts/ext/deploy/logging.properties
  • executor x64-x23/executor/scriрts/ext/deploy/management-agent.jar
    .jar
  • executor x64-x23/executor/scriрts/ext/deploy/messages.properties
    .jnlp
  • executor x64-x23/executor/scriрts/ext/deploy/messages_de.properties
    .jnlp
  • executor x64-x23/executor/scriрts/ext/deploy/messages_es.properties
  • executor x64-x23/executor/scriрts/ext/deploy/messages_fr.properties
    .jnlp
  • executor x64-x23/executor/scriрts/ext/deploy/messages_it.properties
  • executor x64-x23/executor/scriрts/ext/deploy/messages_ja.properties
    .jnlp
  • executor x64-x23/executor/scriрts/ext/deploy/messages_ko.properties
    .jnlp
  • executor x64-x23/executor/scriрts/ext/deploy/messages_pt_BR.properties
    .jnlp
  • executor x64-x23/executor/scriрts/ext/deploy/messages_sv.properties
    .jnlp
  • executor x64-x23/executor/scriрts/ext/deploy/messages_zh_CN.properties
    .jnlp
  • executor x64-x23/executor/scriрts/ext/deploy/messages_zh_HK.properties
    .jnlp
  • executor x64-x23/executor/scriрts/ext/deploy/messages_zh_TW.properties
    .jnlp
  • executor x64-x23/executor/scriрts/ext/deploy/meta-index
  • executor x64-x23/executor/scriрts/ext/deploy/net.properties
  • executor x64-x23/executor/scriрts/ext/deploy/psfont.properties.ja
  • executor x64-x23/executor/scriрts/ext/deploy/psfontj2d.properties
  • executor x64-x23/executor/scriрts/ext/deploy/splash.gif
    .gif
  • executor x64-x23/executor/scriрts/ext/deploy/[email protected]
    .gif
  • executor x64-x23/executor/scriрts/ext/deploy/splash_11-lic.gif
    .gif
  • executor x64-x23/executor/scriрts/ext/deploy/[email protected]
    .gif
  • executor x64-x23/executor/scriрts/ext/dnsns.jar
    .jar
  • executor x64-x23/executor/scriрts/ext/images/cursors/cursors.properties
  • executor x64-x23/executor/scriрts/ext/images/cursors/invalid32x32.gif
    .gif
  • executor x64-x23/executor/scriрts/ext/images/cursors/win32_CopyDrop32x32.gif
    .gif
  • executor x64-x23/executor/scriрts/ext/images/cursors/win32_CopyNoDrop32x32.gif
    .gif
  • executor x64-x23/executor/scriрts/ext/images/cursors/win32_LinkDrop32x32.gif
    .gif
  • executor x64-x23/executor/scriрts/ext/images/cursors/win32_LinkNoDrop32x32.gif
    .gif
  • executor x64-x23/executor/scriрts/ext/images/cursors/win32_MoveDrop32x32.gif
    .gif
  • executor x64-x23/executor/scriрts/ext/images/cursors/win32_MoveNoDrop32x32.gif
    .gif
  • executor x64-x23/executor/scriрts/ext/jaccess.jar
    .jar
  • executor x64-x23/executor/scriрts/ext/jfr/default.jfc
    .xml
  • executor x64-x23/executor/scriрts/ext/jfr/profile.jfc
    .xml
  • executor x64-x23/executor/scriрts/ext/jfxrt.jar
    .jar
  • executor x64-x23/executor/scriрts/ext/localedata.jar
    .jar
  • executor x64-x23/executor/scriрts/ext/management/jmxremote.access
  • executor x64-x23/executor/scriрts/ext/management/jmxremote.password.template
  • executor x64-x23/executor/scriрts/ext/management/management.properties
  • executor x64-x23/executor/scriрts/ext/management/snmp.acl.template
  • executor x64-x23/executor/scriрts/ext/meta-index
  • executor x64-x23/executor/scriрts/ext/nashorn.jar
    .jar
  • executor x64-x23/executor/scriрts/ext/security/blacklist
  • executor x64-x23/executor/scriрts/ext/security/blacklisted.certs
  • executor x64-x23/executor/scriрts/ext/security/cacerts
  • executor x64-x23/executor/scriрts/ext/security/java.policy
  • executor x64-x23/executor/scriрts/ext/security/java.security
  • executor x64-x23/executor/scriрts/ext/security/javaws.policy
  • executor x64-x23/executor/scriрts/ext/security/policy/limited/US_export_policy.jar
    .jar
  • executor x64-x23/executor/scriрts/ext/security/policy/limited/local_policy.jar
    .jar
  • executor x64-x23/executor/scriрts/ext/security/policy/unlimited/US_export_policy.jar
    .jar
  • executor x64-x23/executor/scriрts/ext/security/policy/unlimited/local_policy.jar
    .jar
  • executor x64-x23/executor/scriрts/ext/security/public_suffix_list.dat
    .zip
  • executor x64-x23/executor/scriрts/ext/sunec.jar
    .jar
  • executor x64-x23/executor/scriрts/ext/sunjce_provider.jar
    .jar
  • executor x64-x23/executor/scriрts/ext/sunmscapi.jar
    .jar
  • executor x64-x23/executor/scriрts/ext/sunpkcs11.jar
    .jar
  • executor x64-x23/executor/scriрts/ext/zipfs.jar
    .jar
  • executor x64-x23/executor/scriрts/nvspapi64.dll
    .dll windows:6 windows x64 arch:x64

    977f887ba1716db690f3f6cd927adbd9


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • executor x64-x23/executor/weapon.lua