zgrat | 61c238534f84165056c04381a095c2d1[.]bin | Triage

Sharing

General

Target

61c238534f84165056c04381a095c2d1.bin
Size

1.4MB
MD5

039d03aeb0ea4c7e00efcebe08dbe0a3
SHA1

f5ff32d048f9235298daf59c7d19b5f5f17fb61f
SHA256

bebf3f496c8a63d33e685bb2a721932097164991e53a115a9f407b915de3981f
SHA512

157ffc2878820eb1c565c4a6e03dda26ceba37b30e64e8e22578814e4a5ca0d1fa44ac8f58b3c9b14159e287f1590f787b9dff19d36e86b56365fd89842dae83
SSDEEP

24576:tkM83NuYn5pF9iVTIlzbM7v5tnJvKSUxvt2rWJaTrc28LEBRDipM:tBiuW5KTIFw9tsxt3eBlUM

Score

10^/10

zgrat

Malware Config

Signatures

Detect ZGRat V1 1 IoCs

resource	yara_rule
static1/unpack001/e0ee6e58b847764517e78ccb5932eca4cc78e7d442170bf3329daae8324af694.exe	family_zgrat_v1

Zgrat family
zgrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/e0ee6e58b847764517e78ccb5932eca4cc78e7d442170bf3329daae8324af694.exe

Files

61c238534f84165056c04381a095c2d1.bin
.zip

Password: infected
e0ee6e58b847764517e78ccb5932eca4cc78e7d442170bf3329daae8324af694.exe
.exe windows:4 windows x86 arch:x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 880B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ