Extracted

Extracted

• • Target
    Narsil.exe
  • Size 146.9MB
  • SHA256 33e28ac931d8477eb8d20603b7b8d8cd55a4356ef106d24b02fa3a36be0ee087
  • MD5 a3e747b0e917fe4e066eb1c40729c97a
  • SHA1 05d0cab40ea39437451b4f7a1058bbc34f9c0aa8
  • SHA512 762dd71cbce06cafff547c3f4a9be0d51899797eaa676b00556778fb27f25649890cacc3efe1af7b3d36a259917185e2509e125444d5552935e2f5a8b873029e
  • SSDEEP 49152:pKS9lXHCklzCAMKtoCKt0KKEtDiDJibri0Bp1D:oUXHCIWAMIoBWjCDeL0Bp1D
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  riseprozgratratstealersystembccollectiondiscoverypersistencespywaretrojan

  • Detect ZGRat V1

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

    trojansystembc

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3behavioral4
• • Target
    SurrogateServerIntoSvc.exe
  • Size 147.8MB
  • SHA256 df18a66e0d7dac7371e4371005a83e4735f5e22377b28f00bb0f41a3feee92a5
  • MD5 498289ebcaf79eb8c4d1b32fda603ccc
  • SHA1 5ba78056884ab0e19a81da9b95c8e1e7e8e7d2f6
  • SHA512 492585cb98fd1608b9a30f82e7bf5480e4b483ea586375425ce39d805df2674cb81cf91d966ce0565c6b82479f88051398651e0191201f293f3e548f7e1051a7
  • SSDEEP 49152:ndm9asqLK/r8ZOwN/Eqy8QDWGCYhYp/81SArFv29qh1z4S:n4whZOwNaDeR/uSyt29qDz
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  zgratrat

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral5behavioral6behavioral7behavioral8
• • Target
    winserverupd.exe
  • Size 91KB
  • SHA256 c06da1d7ce6843074ae3a964dc8aa862151f2196c0e15964d3d9959a44ba89f8
  • MD5 607acc5a6b670bd144bf3897cda6b233
  • SHA1 24a2fc93216adb3543ee555473b2f61f333384d2
  • SHA512 75bd3c2fe2a6b96586e0e1ecf5d282d55f71fb9891961ca1dd6c6be90eaa9a196fd62c8343abfdb039e384895a593f2a01c725451c580980f238c40d764b4643
  • SSDEEP 1536:r7fPGykbOqjoHm4pICdfkLtAfupcWX50MxFY+yIOlnToIfLx4fmSxL2MO2:nq6+ouCpk2mpcWJ0r+QNTBfLyfmSBR
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  evasiontrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Modifies security service

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral10behavioral11behavioral12behavioral9