zgrat

General

Target
e9d5206109ad1c3a34b863fa42ee6e40_JaffaCakes118
Size 3.5MB
Sample240409-m2k73sdc44
SHA256 c3e1f7bd5dfa81bb5c55a12d804184f0ae5607bbe5a191ba4984c5cd36d89da2
MD5 e9d5206109ad1c3a34b863fa42ee6e40
SHA1 6543398463a12685648d4a5876965bee3af17b5c
SHA512 c4df9ec3d8b7b4b9fc3e8b29a0c49911b84faa5a805329e583d70099e1335a4337781d7278376d8db8f52eb31ec07b2e2db6bc9fc278075eb0c8c4bd239a0998
SSDEEP 49152:LXenjmTRNtf1ihnlxlF2H6dfqS3q6o7h0D9kPV969oHZGrGeXa2cyM1bKzNqAfn3:LXs8tf0xlzJxo7hi9cbZPk4bKnP3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  e9d5206109ad1c3a34b863fa42ee6e40_JaffaCakes118
- Size 3.5MB
- SHA256 c3e1f7bd5dfa81bb5c55a12d804184f0ae5607bbe5a191ba4984c5cd36d89da2
- MD5 e9d5206109ad1c3a34b863fa42ee6e40
- SHA1 6543398463a12685648d4a5876965bee3af17b5c
- SHA512 c4df9ec3d8b7b4b9fc3e8b29a0c49911b84faa5a805329e583d70099e1335a4337781d7278376d8db8f52eb31ec07b2e2db6bc9fc278075eb0c8c4bd239a0998
- SSDEEP 49152:LXenjmTRNtf1ihnlxlF2H6dfqS3q6o7h0D9kPV969oHZGrGeXa2cyM1bKzNqAfn3:LXs8tf0xlzJxo7hi9cbZPk4bKnP3
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

zgrat evasion rat themida trojan
- Detect ZGRat V1
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detect ZGRat V1

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Themida packer

Checks whether UAC is enabled

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2