zgrat

General

Target

08cee68cb913dd71800f0283c49af6d3.bin
Size

2.2MB
Sample

240506-bc2mzsef94
MD5

28daef0241fe24f623b8fd906765fd3c
SHA1

4fa3206ca20972090b38c9adbdfdfeaa6a9072e0
SHA256

984365c57e2ee4f28bb44d63e31172a2fa6fd7ac1f696fabf02b6ed9bcb15397
SHA512

c3d664aabfc15c4533d05bf5ee06ebbbc3697a5149d7d6f9efad2c55f081203ce752b19cfe3f3fff872956e8349435b952a0eea6e1ca86ad269352a9d16280e4
SSDEEP

49152:9bDa0bnJMeNIZNVoaMrxkc6ZEHgD5OBuP/Tq2fa6:YMOemZNqF7StMuPu2j

Score

10^/10

Malware Config

Extracted

Path

C:\bQ8ODxIi2.README.txt

Ransom Note

~~~ AlphaCat ~~~ >>>> Your data are stolen and encrypted >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. Life is too short to be sad. Be not sad, money, it is only paper. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack worldwide and there is no dissatisfied victim after payment. >>>> You need contact us via email with srenshot of btc transaction and your personal DECRYPTION ID Contact via Email with your personal Decryption id !: [email protected] Send 400$ (0.006 BTC) at this address --> bc1qkr7wxuqwet9w6920vk94p7npkxh33fc7prv55q >>>> Your personal DECRYPTION ID: D53F15BF767167BCE76F1A7030FFAFDE >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack repeatedly again!

Emails

[email protected]

Extracted

Path

C:\bQ8ODxIi2.README.txt

Ransom Note

~~~ AlphaCat ~~~ >>>> Your data are stolen and encrypted >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. Life is too short to be sad. Be not sad, money, it is only paper. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack worldwide and there is no dissatisfied victim after payment. >>>> You need contact us via email with srenshot of btc transaction and your personal DECRYPTION ID Contact via Email with your personal Decryption id !: [email protected] Send 400$ (0.006 BTC) at this address --> bc1qkr7wxuqwet9w6920vk94p7npkxh33fc7prv55q >>>> Your personal DECRYPTION ID: D53F15BF767167BC50E9A194162EAA2F >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack repeatedly again!

Emails

[email protected]

Targets

- Target
  
  5c004c361f19687d6c34c6d49c81b4736e8223f183b63aafec635613daae89ad.exe
- Size
  
  2.2MB
- MD5
  
  08cee68cb913dd71800f0283c49af6d3
- SHA1
  
  eb4058134cd74c681445a1a81c31ef729c80a7ec
- SHA256
  
  5c004c361f19687d6c34c6d49c81b4736e8223f183b63aafec635613daae89ad
- SHA512
  
  1052130474915e5256c1bcc95636489535e38ca23cfb615e6b0e8b6c37c6c6ba89aa793a9aac9321d843d0cd0c6f10c85a30b2b689531c457638ce26555276fc
- SSDEEP
  
  49152:+8cRU4kwcctnR19Y1Iqdwc2EyEvh6Re14IIQ+cUznT9PuYXVWXCxzhm:+TXkw5RWlifE3vwVIB+cnYXkgm
Score

10^/10

zgrat ransomware rat spyware stealer
- Detect ZGRat V1
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Renames multiple (310) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2