Overview

overview

10

Static

static

10

35b1aa7fcf...KI.exe

windows7-x64

10

35b1aa7fcf...KI.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    35b1aa7fcfc905e8f90d828241445b90_NEIKI

  • Size

    623KB

  • Sample

    240508-yxpkgsdb9z

  • MD5

    35b1aa7fcfc905e8f90d828241445b90

  • SHA1

    823097137ef76e7d0d321fb481be9caf3e47bb53

  • SHA256

    50db11e74c1fdfd0a52aa976861fa8604af32352a2b333fdcb25f22062c29a24

  • SHA512

    90276b9cc7adb80af57b9089e41758236f7b5791ce79a0000c630092fa992db8fb854389b2c689f6222c193846261d8369e6f3e409d80aece54995b0c3c499c6

  • SSDEEP

    12288:GcqE4rUamXJZXjK8XkiH9qXeUlnvJ0udha2ssE4EDRyl+m4SjBoa2:GctKUPHEDV1nvssODRrmBoa

Score
10/10
zgratevasionpersistenceratspywarestealer

Malware Config

Targets

    • Target

      35b1aa7fcfc905e8f90d828241445b90_NEIKI

    • Size

      623KB

    • MD5

      35b1aa7fcfc905e8f90d828241445b90

    • SHA1

      823097137ef76e7d0d321fb481be9caf3e47bb53

    • SHA256

      50db11e74c1fdfd0a52aa976861fa8604af32352a2b333fdcb25f22062c29a24

    • SHA512

      90276b9cc7adb80af57b9089e41758236f7b5791ce79a0000c630092fa992db8fb854389b2c689f6222c193846261d8369e6f3e409d80aece54995b0c3c499c6

    • SSDEEP

      12288:GcqE4rUamXJZXjK8XkiH9qXeUlnvJ0udha2ssE4EDRyl+m4SjBoa2:GctKUPHEDV1nvssODRrmBoa

    Score
    10/10
    zgratevasionpersistenceratspywarestealer

    • Detect ZGRat V1

    • Modifies visibility of file extensions in Explorer

      evasion

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks