Overview

overview

10

Static

static

1

ad61418203...35.cmd

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    ad6141820386639133953308360445558077741366324631087357035 (1).7z
  • Size 2.5MB
  • Sample240509-vmarssfh97
  • SHA256 0da37f4dc45bda166d0ad59523a097be39f5a3d774aa843620e204f7995ff2c1
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
zgratpersistencerat

Malware Config

Targets

    • Target
      ad6141820386639133953308360445558077741366324631087357035.cmd
    • Size 3.2MB
    • SHA256 795932d040c08e9122325bcbfb4a428398ec38d7b3937e0e6154c8d40d66c724
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    zgratpersistencerat

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks