zgrat

General

Target

17eb4c4e58353a5db52602d0ae321fbd.bin
Size

1.5MB
Sample

240507-bev8zsbd6x
MD5

cb7afda57d8870688dd31f212db5fd7b
SHA1

4f5e3cc40481139669bcaaa461c8b059e2b1186e
SHA256

cfe275730764d39a1638d54ab8d991bc4865ec7a39b90da8b23a7b4957944b45
SHA512

8499aed3885dfb8fbf99a72a9d7918c6b2077e1db5f359fcce0a9ffc2f2d25e1c686467086ada160b9ab6d4c4418359cf604c95fd41e5cd2b520c1ae6c8dfc82
SSDEEP

24576:gnVcZL99iab7Ovqhjq4JCGh6YXJ5fgK70av6MGzbLW54NukukXrByxtNZ3XSaPtZ:gnu9nOviVjTX406Mgbakukb0R9Vup9dW

Score

10^/10

Malware Config

Targets

- Target
  
  22ed346e6e5849b9a4ddc0f372382b062fe50145a4425562976531eb2b0819e1.exe
- Size
  
  1.9MB
- MD5
  
  17eb4c4e58353a5db52602d0ae321fbd
- SHA1
  
  791e65e864b8831b86149c079b09d04cac894e59
- SHA256
  
  22ed346e6e5849b9a4ddc0f372382b062fe50145a4425562976531eb2b0819e1
- SHA512
  
  a93540c9b59a5000ef53834ff920d8fafa3e1d25da92ead4d523dc684d3824a6e3ccefda736194c0ec1a2e27229ea4096afd65be3ff462fd2e4f22c6058d8d14
- SSDEEP
  
  24576:kGcK2o1bNcsQSVR7z/7VlQR/Ys6Yy0RbZEd3oJ30mJrqTgOEOkm6GNBO0mQP:7l777HagqbZoaEoki5m6G/FmQ
Score

10^/10

zgrat execution persistence rat spyware stealer
- Detect ZGRat V1
- Modifies WinLogon for persistence
  persistence
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
behavioral1 behavioral2