Overview

overview

10

Static

static

3

file.exe

windows7-x64

3

file.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    file.exe

  • Size

    5.3MB

  • Sample

    240419-bnyepsde21

  • MD5

    6d075d047098d57266aa59b97d288bda

  • SHA1

    1cb3eabf3ddbf47ea0f9eebac64b6689f7645cc1

  • SHA256

    fabd087044389ec6e9d7e11f59687c9527e0aec25a83f8dae30da8404efe0e39

  • SHA512

    9167cabbeca956b977d2ec2e88f8d1c03511d2271850df7e1d01e1b2fd76ac4534e782c236ad28fe92cee94b289a8c8ba74f1ec35b9028b70339adc4af3dfa69

  • SSDEEP

    98304:+3G06n81vgUXP6+UXGLVk+3UXLtIhLuzXAapVgPrvqE3LDvuseWMeX:+3Gdn4oQP6L+3MLOJuzXXTgzP3ZeWF

Score
10/10
xmrigzgratminerrat

Malware Config

Targets

    • Target

      file.exe

    • Size

      5.3MB

    • MD5

      6d075d047098d57266aa59b97d288bda

    • SHA1

      1cb3eabf3ddbf47ea0f9eebac64b6689f7645cc1

    • SHA256

      fabd087044389ec6e9d7e11f59687c9527e0aec25a83f8dae30da8404efe0e39

    • SHA512

      9167cabbeca956b977d2ec2e88f8d1c03511d2271850df7e1d01e1b2fd76ac4534e782c236ad28fe92cee94b289a8c8ba74f1ec35b9028b70339adc4af3dfa69

    • SSDEEP

      98304:+3G06n81vgUXP6+UXGLVk+3UXLtIhLuzXAapVgPrvqE3LDvuseWMeX:+3Gdn4oQP6L+3MLOJuzXXTgzP3ZeWF

    Score
    10/10
    xmrigzgratminerrat

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • .NET Reactor proctector

      Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks