Behavioral task
behavioral1
Sample
7a07728e8aabc1005f849cff95f6f3458111bb64684993c883fbf929fff215cb.exe
Resource
win7-20240215-en
General
-
Target
7a07728e8aabc1005f849cff95f6f3458111bb64684993c883fbf929fff215cb.exe
-
Size
270KB
-
MD5
186749a39e4dbfc7d3fd176b45a8bb11
-
SHA1
5ed63dc0900218bd2f6279a5ee413f248e3460d1
-
SHA256
7a07728e8aabc1005f849cff95f6f3458111bb64684993c883fbf929fff215cb
-
SHA512
aba49310768dd46c18f96959edb3859f5fa6023b854f038eac566ef8bc9c6ed8356b0da578fd64706b3da54de1435bd07656e0fa6ae132df2667ce3e6257b98c
-
SSDEEP
3072:UcqdvDlxdVkgauXKIIsWSiu1eWvjWu/8OJzehzmSO9jNXOqN+K3VJLlgUnMF2USC:UcqtD/knuZpl18OVSud13TO2gx0rU
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
resource yara_rule sample family_zgrat_v1 -
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
-
Zgrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7a07728e8aabc1005f849cff95f6f3458111bb64684993c883fbf929fff215cb.exe
Files
-
7a07728e8aabc1005f849cff95f6f3458111bb64684993c883fbf929fff215cb.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 266KB - Virtual size: 265KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ