Overview

overview

10

Static

static

3

860318a998...55.exe

windows7-x64

10

860318a998...55.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    16f3f68d9285010c65b96a611587a8946755448cfb9711fd9422c71d2c3dedc4

  • Size

    515KB

  • Sample

    240417-rxjkxadf8s

  • MD5

    ee36c9e93bc1be848d62dd4bf3385ad5

  • SHA1

    d32ae74c9f1d111404231e4a6a9b8e7e3f0a982e

  • SHA256

    16f3f68d9285010c65b96a611587a8946755448cfb9711fd9422c71d2c3dedc4

  • SHA512

    54d1e6ad1ae4cb49ae20fc8e01e44d9fc432b514566bdd2858d557885060830cdc0d7c0b578d100fb5197123a7f013492871677e432253c487a47fc2d26c1091

  • SSDEEP

    12288:Y5/5dccL5mWeRV/+a++KRuY0VXxGo+14cU8R5SQ0VbsT3r+FqTP:Axdc7RVL+T0VXftcHRkqH+Ab

Score
10/10
systembczgratpersistencerattrojan

Malware Config

Extracted

Family

systembc

C2

69.10.60.115:4018

Targets

    • Target

      860318a9982e93b8833e68bef2e4d70d81ed06747571ffb9312dacf4a2ae2855.exe

    • Size

      692KB

    • MD5

      203be5c7c37fcaea3ee5f1101e310abd

    • SHA1

      3041d34cb5a1a4b1a0c5f0f1ae3389b8d8e16c9d

    • SHA256

      860318a9982e93b8833e68bef2e4d70d81ed06747571ffb9312dacf4a2ae2855

    • SHA512

      9cde98d27be7e7b794e20d36747ab0b74776f19fb69a6f96b772248350a18dc13223f9fb547fb96e05cf92185af0b18fcf5e57f3f613ac252e80cd19b41e6278

    • SSDEEP

      12288:SfV3CVqJtda2YQm1Zp6Ed16Ajp8rTGlzDxkZ7ba3EBgi:Sd3CsJnYQM/6Ed16Ajy40ba3EZ

    Score
    10/10
    systembczgratpersistencerattrojan

    • Detect ZGRat V1

    • SystemBC

      SystemBC is a proxy and remote administration tool first seen in 2019.

      trojansystembc

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks