zgrat

General

Target

ef52e496deef5f97729b97696c20c43eae3b183ac23711beab021693f37be761.exe
Size

830KB
Sample

240428-cnqwased2s
MD5

4083c7b8b4ba81bf66179b0b7072bdab
SHA1

ee01f16e7fc58dc37d245de797de118f751c0824
SHA256

ef52e496deef5f97729b97696c20c43eae3b183ac23711beab021693f37be761
SHA512

10d38d5baabe19f331b10a1548fa2d2ef028c16aba087f65595733fd107bcf9524939cbd050aa5501931bf559923cb44ac49c817aea111f0acdefa02af211d92
SSDEEP

12288:1gaKDyLliWtG1VXiTtcB9AC0bipbZ3cxRA9JSi6stKSsiblxmPd5R:vGDCt0H01if6VxiZEPd5

Score

10^/10

Malware Config

Targets

- Target
  
  ef52e496deef5f97729b97696c20c43eae3b183ac23711beab021693f37be761.exe
- Size
  
  830KB
- MD5
  
  4083c7b8b4ba81bf66179b0b7072bdab
- SHA1
  
  ee01f16e7fc58dc37d245de797de118f751c0824
- SHA256
  
  ef52e496deef5f97729b97696c20c43eae3b183ac23711beab021693f37be761
- SHA512
  
  10d38d5baabe19f331b10a1548fa2d2ef028c16aba087f65595733fd107bcf9524939cbd050aa5501931bf559923cb44ac49c817aea111f0acdefa02af211d92
- SSDEEP
  
  12288:1gaKDyLliWtG1VXiTtcB9AC0bipbZ3cxRA9JSi6stKSsiblxmPd5R:vGDCt0H01if6VxiZEPd5
Score

10^/10

zgrat rat spyware stealer
- Detect ZGRat V1
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Detect packed .NET executables. Mostly AgentTeslaV4.
- Detects executables packed with unregistered version of .NET Reactor
- .NET Reactor proctector
  Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

4

T1552

Credentials In Files

3

T1552.001

Credentials in Registry

1

T1552.002

Discovery

Lateral Movement

Collection

Data from Local System

4

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detect ZGRat V1

Detect packed .NET executables. Mostly AgentTeslaV4.

Detects executables packed with unregistered version of .NET Reactor

.NET Reactor proctector

Reads WinSCP keys stored on the system

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Looks up external IP address via web service

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2