Overview

overview

10

Static

static

10

e0ee6e58b8...94.exe

windows7-x64

10

e0ee6e58b8...94.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e0ee6e58b847764517e78ccb5932eca4cc78e7d442170bf3329daae8324af694.exe

  • Size

    1.8MB

  • Sample

    240428-ckr9ysec4v

  • MD5

    61c238534f84165056c04381a095c2d1

  • SHA1

    5b1257815babefde6c7308e445bfb41d6c5615a9

  • SHA256

    e0ee6e58b847764517e78ccb5932eca4cc78e7d442170bf3329daae8324af694

  • SHA512

    5725219c07e2fc29a330b8b40782e4593f7564483bf6c87f114ac61ace73ca8e2c8e621aa807a978aacc947d44ff2ec139253b470671720f26c80f1ba222bcc5

  • SSDEEP

    24576:BVe9eTp00PQriWf39Ush3bzcWiTTgiYSoLykSQp5QOhGxQ/7nLVNzv:B0sQrVv1RbgWsTgiBcpSWthGxOLVNz

Score
10/10
zgratratspywarestealer

Malware Config

Targets

    • Target

      e0ee6e58b847764517e78ccb5932eca4cc78e7d442170bf3329daae8324af694.exe

    • Size

      1.8MB

    • MD5

      61c238534f84165056c04381a095c2d1

    • SHA1

      5b1257815babefde6c7308e445bfb41d6c5615a9

    • SHA256

      e0ee6e58b847764517e78ccb5932eca4cc78e7d442170bf3329daae8324af694

    • SHA512

      5725219c07e2fc29a330b8b40782e4593f7564483bf6c87f114ac61ace73ca8e2c8e621aa807a978aacc947d44ff2ec139253b470671720f26c80f1ba222bcc5

    • SSDEEP

      24576:BVe9eTp00PQriWf39Ush3bzcWiTTgiYSoLykSQp5QOhGxQ/7nLVNzv:B0sQrVv1RbgWsTgiBcpSWthGxOLVNz

    Score
    10/10
    zgratratspywarestealer

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Detects executables packed with unregistered version of .NET Reactor

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks