Overview

overview

10

Static

static

1

adguardInstaller.exe

windows10-2004-x64

10

adguardInstaller.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    adguardInstaller.exe

  • Size

    142KB

  • Sample

    240506-vebn5aaf51

  • MD5

    2778418f6e0d048617221386ed96109c

  • SHA1

    bdff4500e90506ec9944691e0f449dc2d7a9454b

  • SHA256

    93e92273784deb9659b37c211cef5366463753a90abbf1e9b9846d82ff7aaadb

  • SHA512

    c7547344992511b53241426b2bb8c2fa55bddf6358300a2bc60a73b42bf7a493822b57a285c718e4b3cc6ed0bbbc22069fb0d908ff8e77c4e92337fd0d7cb6f0

  • SSDEEP

    3072:r4qZHnMyBV3vChLFvGyfmKvK9MkBry8wpspx:r4qZHdV3vevK9MkhkpYx

Score
10/10
zgratdiscoverypersistencerat

Malware Config

Targets

    • Target

      adguardInstaller.exe

    • Size

      142KB

    • MD5

      2778418f6e0d048617221386ed96109c

    • SHA1

      bdff4500e90506ec9944691e0f449dc2d7a9454b

    • SHA256

      93e92273784deb9659b37c211cef5366463753a90abbf1e9b9846d82ff7aaadb

    • SHA512

      c7547344992511b53241426b2bb8c2fa55bddf6358300a2bc60a73b42bf7a493822b57a285c718e4b3cc6ed0bbbc22069fb0d908ff8e77c4e92337fd0d7cb6f0

    • SSDEEP

      3072:r4qZHnMyBV3vChLFvGyfmKvK9MkBry8wpspx:r4qZHdV3vevK9MkhkpYx

    Score
    10/10
    zgratdiscoverypersistencerat

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Drops file in Drivers directory

    • Manipulates Digital Signatures

      Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

    • Adds Run key to start application

      persistence

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies Installed Components in the registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks