Overview

overview

10

Static

static

1

27ac58d732...18.exe

windows7-x64

10

27ac58d732...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    27ac58d73248ebb72b350a1d0642e866_JaffaCakes118

  • Size

    2.9MB

  • Sample

    240509-bz1n7sbb8w

  • MD5

    27ac58d73248ebb72b350a1d0642e866

  • SHA1

    88697d4f4d6e00a8ff29083a1a97c8d150f8939b

  • SHA256

    bc2612aeae58ca2f8eaee44f3da03e34fac8a6c95f5afc083d188587c684f349

  • SHA512

    db8c968b3415d02868bc0fb01cb6104504a058c3f6dd1769a8e56bb1c47ed830e2b8d8e9873cd6fbfd15dfff4d46999f1562cb06c8427d9b007108ad1793f998

  • SSDEEP

    49152:LsOFQleKVdNyJly8CcE/mPPgugoRpPNYYjzB6Ri2rC66G4ioVq7oBRff:3aZvyJlAcEmPXzYLCzhiK4oB9

Score
10/10
zgratevasionrattrojan

Malware Config

Targets

    • Target

      27ac58d73248ebb72b350a1d0642e866_JaffaCakes118

    • Size

      2.9MB

    • MD5

      27ac58d73248ebb72b350a1d0642e866

    • SHA1

      88697d4f4d6e00a8ff29083a1a97c8d150f8939b

    • SHA256

      bc2612aeae58ca2f8eaee44f3da03e34fac8a6c95f5afc083d188587c684f349

    • SHA512

      db8c968b3415d02868bc0fb01cb6104504a058c3f6dd1769a8e56bb1c47ed830e2b8d8e9873cd6fbfd15dfff4d46999f1562cb06c8427d9b007108ad1793f998

    • SSDEEP

      49152:LsOFQleKVdNyJly8CcE/mPPgugoRpPNYYjzB6Ri2rC66G4ioVq7oBRff:3aZvyJlAcEmPXzYLCzhiK4oB9

    Score
    10/10
    zgratevasionrattrojan

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks