Analysis
-
max time kernel
149s -
max time network
277s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
18-04-2024 07:15
General
-
Target
Quasar_Gold/Include/dotNET_Reactor.exe
-
Size
5.8MB
-
MD5
7429e30caa2a8b41d926ffef1a05b347
-
SHA1
32abbd56225cd7379bb1cca8f6749d43916efe2b
-
SHA256
1efc5368bcd9704d7df85e2e143936d6ee4509ac31a7ca6d3eb4cf3b18c5ef27
-
SHA512
55243a97d9a7fcd43d531bb61615e734c8bfea242f6e28d67ce09cee586d032d83709a3b8c4ecf9b567252a53d1dad1853aca669316aa2ae62422386156b77c1
-
SSDEEP
49152:VoMLez0fgPdLl8HC5IaKSihCwc0YMOBf7BfKjGO+XYSaqNuT1i:Vy0fgPVwy70GUO
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Quasar_Gold\Include\dotNET_Reactor.exe"C:\Users\Admin\AppData\Local\Temp\Quasar_Gold\Include\dotNET_Reactor.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD5bc6887aa21e7794a2c27e3ffd3dc3ed0
SHA12b845941c93094d7203553582f69d0c61a9fcee4
SHA256919130e16d33fd58d0370b06b7fb0fc253f5b571fc33ad5c21eb8dafe4760c94
SHA5129e952ae72851ba081809ea5d7a86108b0355f0882bae912e0ecf931fde2e878994142b6c16094473305392981439e49d9a32aa6aaf94edd07238a0ecb787e834
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
408KB
-
Filesize
4KB
-
Filesize
40KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
160KB
-
Filesize
5.8MB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
584KB
-
Filesize
5.6MB
-
Filesize
128KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4.8MB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB