Overview

overview

10

Static

static

3

a10d2a2335...3a.exe

windows7-x64

10

a10d2a2335...3a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a10d2a23354cf0130e15d2bf55148e7c34131033b62500615a60bb6f13f0c53a.exe

  • Size

    6.1MB

  • Sample

    240509-b91rysee64

  • MD5

    5186cafa1e8ce4e242411acc52996aaa

  • SHA1

    c14b7773f62bb601e4f910ae595cbc8d1f641c32

  • SHA256

    a10d2a23354cf0130e15d2bf55148e7c34131033b62500615a60bb6f13f0c53a

  • SHA512

    a351d17942033364fe8e8e48673c25a1b7988c83432961e35a036d54ab08c9a3b095b5784de9d7442e31f42e41401aaec79b3facd96fcd9a9fa93afd283eb42b

  • SSDEEP

    196608:ZwHfJ12mWXFSrOyruZ1e1l+Sc6Z2Fd6GymVVdq:QIFSrOwk0m3a9hMA

Score
10/10
zgratevasionratspywarestealer

Malware Config

Targets

    • Target

      a10d2a23354cf0130e15d2bf55148e7c34131033b62500615a60bb6f13f0c53a.exe

    • Size

      6.1MB

    • MD5

      5186cafa1e8ce4e242411acc52996aaa

    • SHA1

      c14b7773f62bb601e4f910ae595cbc8d1f641c32

    • SHA256

      a10d2a23354cf0130e15d2bf55148e7c34131033b62500615a60bb6f13f0c53a

    • SHA512

      a351d17942033364fe8e8e48673c25a1b7988c83432961e35a036d54ab08c9a3b095b5784de9d7442e31f42e41401aaec79b3facd96fcd9a9fa93afd283eb42b

    • SSDEEP

      196608:ZwHfJ12mWXFSrOyruZ1e1l+Sc6Z2Fd6GymVVdq:QIFSrOwk0m3a9hMA

    Score
    10/10
    zgratevasionratspywarestealer

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Detects executables packed with unregistered version of .NET Reactor

    • Disables Task Manager via registry modification

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks