Overview

overview

10

Static

static

1

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    1b672526eaef5bdddfcb1516db739a86d6c5a916f65a673bd9628a33d138a990

  • Size

    1.3MB

  • Sample

    240429-fhb2qsah52

  • MD5

    3aa73406f878b7cb213e654a047d8399

  • SHA1

    353e7abd8a726c1be6ae7e2a44bd0f3a6d1c9566

  • SHA256

    1b672526eaef5bdddfcb1516db739a86d6c5a916f65a673bd9628a33d138a990

  • SHA512

    509bf6807db0ee461bc0cd9c2c79a37a9e09ac3e43f489be5ba0cb9da60a4e4d15c5d1b2e581c455e90138cefc8638decac4f4c43c83113feb625be789c1cda9

  • SSDEEP

    24576:HNZ7Kb9pbvRPXtpsCvqrpLTZrOv7eMfLgP3BJzDWGbMf30yF+fvVH:t0bn7R/tV8tTZrOTeMfMP3BJuGbW+fvt

Score
10/10
zgratpersistenceratspywarestealer

Malware Config

Targets

    • Target

      1b672526eaef5bdddfcb1516db739a86d6c5a916f65a673bd9628a33d138a990

    • Size

      1.3MB

    • MD5

      3aa73406f878b7cb213e654a047d8399

    • SHA1

      353e7abd8a726c1be6ae7e2a44bd0f3a6d1c9566

    • SHA256

      1b672526eaef5bdddfcb1516db739a86d6c5a916f65a673bd9628a33d138a990

    • SHA512

      509bf6807db0ee461bc0cd9c2c79a37a9e09ac3e43f489be5ba0cb9da60a4e4d15c5d1b2e581c455e90138cefc8638decac4f4c43c83113feb625be789c1cda9

    • SSDEEP

      24576:HNZ7Kb9pbvRPXtpsCvqrpLTZrOv7eMfLgP3BJzDWGbMf30yF+fvVH:t0bn7R/tV8tTZrOTeMfMP3BJuGbW+fvt

    Score
    10/10
    zgratpersistenceratspywarestealer

    • Detect ZGRat V1

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks