Overview

overview

10

Static

static

3

b32f0dffd8...25.exe

windows7-x64

10

b32f0dffd8...25.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b32f0dffd8659a8a2669864edf56c7e4bd369405d3e38daa01360ca2fc1e6825.exe

  • Size

    2.4MB

  • Sample

    240507-b168dafe76

  • MD5

    2c9f8873126d4837e4dec1e9b93fac9e

  • SHA1

    e22b3ed42f3c8ed0bdd7348b0842dce4f668598a

  • SHA256

    b32f0dffd8659a8a2669864edf56c7e4bd369405d3e38daa01360ca2fc1e6825

  • SHA512

    274245a76fb355bd09043db77cf5dda5221bd8a8db0fd592427a1ad7ef9e836d7120c20c44621476095ee2f0eb786881422a4b97ffdc4d2d856bbc0dd427d53a

  • SSDEEP

    49152:jGPXfEWljxz11fwzg1fHwaDybx1K4rRqwtSdpIcTQEBo:6PXp71fwc1fHwaUxRtwIQvBo

Score
10/10
zgratpersistencerat

Malware Config

Targets

    • Target

      b32f0dffd8659a8a2669864edf56c7e4bd369405d3e38daa01360ca2fc1e6825.exe

    • Size

      2.4MB

    • MD5

      2c9f8873126d4837e4dec1e9b93fac9e

    • SHA1

      e22b3ed42f3c8ed0bdd7348b0842dce4f668598a

    • SHA256

      b32f0dffd8659a8a2669864edf56c7e4bd369405d3e38daa01360ca2fc1e6825

    • SHA512

      274245a76fb355bd09043db77cf5dda5221bd8a8db0fd592427a1ad7ef9e836d7120c20c44621476095ee2f0eb786881422a4b97ffdc4d2d856bbc0dd427d53a

    • SSDEEP

      49152:jGPXfEWljxz11fwzg1fHwaDybx1K4rRqwtSdpIcTQEBo:6PXp71fwc1fHwaUxRtwIQvBo

    Score
    10/10
    zgratpersistencerat

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks