Overview

overview

10

Static

static

3

0266dc2bf6...99.exe

windows7-x64

10

0266dc2bf6...99.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe

  • Size

    3.7MB

  • Sample

    240329-ce66xsfb78

  • MD5

    33c53419f5450d013fd20a76468d43d2

  • SHA1

    40b6d4224504f1f0dfea827c8c853dce79a77287

  • SHA256

    0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199

  • SHA512

    e202c49fe373e094e5b619de43e852e0e09edbb9ebda444be762c0b46939f843cf9cffa4f24726e46ac096135b0cdd1332aa0c386c1a4f9525a95910af682c14

  • SSDEEP

    98304:ypcjyoyOglp/VanCJgUEIvX8jMrbL7589kE9PQqP:8s7glp/VaCJAIQs7m9kERQc

Score
10/10
zgratratspywarestealer

Malware Config

Targets

    • Target

      0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe

    • Size

      3.7MB

    • MD5

      33c53419f5450d013fd20a76468d43d2

    • SHA1

      40b6d4224504f1f0dfea827c8c853dce79a77287

    • SHA256

      0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199

    • SHA512

      e202c49fe373e094e5b619de43e852e0e09edbb9ebda444be762c0b46939f843cf9cffa4f24726e46ac096135b0cdd1332aa0c386c1a4f9525a95910af682c14

    • SSDEEP

      98304:ypcjyoyOglp/VanCJgUEIvX8jMrbL7589kE9PQqP:8s7glp/VaCJAIQs7m9kERQc

    Score
    10/10
    zgratratspywarestealer

    • Detect ZGRat V1

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Detects executables packed with unregistered version of .NET Reactor

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks