Overview

overview

10

Static

static

1

adguardVPN...er.exe

windows10-2004-x64

10

adguardVPN...er.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    adguardVPNInstaller.exe

  • Size

    113KB

  • Sample

    240506-vegkdadh74

  • MD5

    0b5f4f07b8a13732b7f54a1996e16a5d

  • SHA1

    c7b3123311defd1cc4a0b7fca89ac2e359d71b05

  • SHA256

    75ebe77d8a99d8f5d8a09ec2d0712d8737a6ceab980fa88f55858d797c427300

  • SHA512

    2ff8ea150d2f496401ae285f8c14f3aaf27f441efe60ee62d3c88b094527e855e0eb7f4694ac1c948a6a8d18f9a2ccfa6edb017678467cff5ee72f00f3ec9a79

  • SSDEEP

    3072:+4GZnrASj3/1QLFvGwFCZ+XH+IG8wpCWy:+4GZrr3/a1BYps

Score
10/10
zgratdiscoverypersistencerat

Malware Config

Targets

    • Target

      adguardVPNInstaller.exe

    • Size

      113KB

    • MD5

      0b5f4f07b8a13732b7f54a1996e16a5d

    • SHA1

      c7b3123311defd1cc4a0b7fca89ac2e359d71b05

    • SHA256

      75ebe77d8a99d8f5d8a09ec2d0712d8737a6ceab980fa88f55858d797c427300

    • SHA512

      2ff8ea150d2f496401ae285f8c14f3aaf27f441efe60ee62d3c88b094527e855e0eb7f4694ac1c948a6a8d18f9a2ccfa6edb017678467cff5ee72f00f3ec9a79

    • SSDEEP

      3072:+4GZnrASj3/1QLFvGwFCZ+XH+IG8wpCWy:+4GZrr3/a1BYps

    Score
    10/10
    zgratdiscoverypersistencerat

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Blocklisted process makes network request

    • Manipulates Digital Signatures

      Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

    • Adds Run key to start application

      persistence

    • Downloads MZ/PE file

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks