zgrat | 15b75648ad8160565cfd4008ae223ce0[.]bin

General

Target
15b75648ad8160565cfd4008ae223ce0.bin
Size 1.4MB
Sample240508-bexrtaab3s
SHA256 43660d12841c026463f346661481cc19a48e18bbb230ceaaa39828ee57d82d2b
MD5 b203d9949831a9f13d09ab0757e810f4
SHA1 4abae8ff66f8aaed2b7d9f0cecd25d3953081446
SHA512 d7bf1a397dc92bb1b332d28d5a3915b4b6e9b662b14d639511a939521e2f782c336f4d19d864a69e0307ecea9af508bf65b2ad290eca4d2d46280f709fe714c8
SSDEEP 24576:cFWivAcIHiFtQ5qeTWplZSeUFkmgTUOiRvWfzanKgKFmB6T5GOqmb04J9GY8ZdIf:krucKuuFPeUOiRvWbanKgKFOqGZmb041
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

zgrat

Malware Config

Signatures

Detect ZGRat V1 1 IoCs

resource	yara_rule
static1/unpack001/81e18d35c83b04e7ee6288294cdfc7ef57af3c44d44788a21577e808b3a99a9d.exe	family_zgrat_v1

Zgrat family
zgrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/81e18d35c83b04e7ee6288294cdfc7ef57af3c44d44788a21577e808b3a99a9d.exe

File Explorer

15b75648ad8160565cfd4008ae223ce0.bin

.zip 1.4MB
81e18d35c83b04e7ee6288294cdfc7ef57af3c44d44788a21577e808b3a99a9d.exe

.exe 1.8MB

15b75648ad8160565cfd4008ae223ce0.bin

SHA256 43660d12841c026463f346661481cc19a48e18bbb230ceaaa39828ee57d82d2b
MD5 b203d9949831a9f13d09ab0757e810f4
SHA1 4abae8ff66f8aaed2b7d9f0cecd25d3953081446
SHA512 d7bf1a397dc92bb1b332d28d5a3915b4b6e9b662b14d639511a939521e2f782c336f4d19d864a69e0307ecea9af508bf65b2ad290eca4d2d46280f709fe714c8
SSDEEP 24576:cFWivAcIHiFtQ5qeTWplZSeUFkmgTUOiRvWfzanKgKFmB6T5GOqmb04J9GY8ZdIf:krucKuuFPeUOiRvWbanKgKFOqGZmb041
MD5 SHA1 SHA512 SSDEEP

Password

infected

81e18d35c83b04e7ee6288294cdfc7ef57af3c44d44788a21577e808b3a99a9d.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 81e18d35c83b04e7ee6288294cdfc7ef57af3c44d44788a21577e808b3a99a9d
MD5 15b75648ad8160565cfd4008ae223ce0
SHA1 2800a25191362b57c9762c74fc668960f11937bc
SHA512 25eb48fd2ea9a2781b6ed82ebc00b6d4df2ddbe57dee366dd39f67f8dcf9c02cf675c9578b11057d07ae0c6d8cc65371971f51df8eac27cc36e0e27d42bc9b0b
SSDEEP 24576:pRr3fEcKSoIu4cMlay9GvZsk8ynlK01Pi5LO1K4Bb/8GeAyb1L5ZXMUJcapQKS3L:TAUpQ8yU26a1KU8ZAyb15ea61pFWcig
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Detect ZGRat V1
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

4

Entry point

1919326

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

15b75648ad8160565cfd4008ae223ce0.bin

81e18d35c83b04e7ee6288294cdfc7ef57af3c44d44788a21577e808b3a99a9d.exe

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

15b75648ad8160565cfd4008ae223ce0.bin

81e18d35c83b04e7ee6288294cdfc7ef57af3c44d44788a21577e808b3a99a9d.exe

mscoree

dotnet