Overview

overview

10

Static

static

3

e0c0a69f8f...62.exe

windows7-x64

1

e0c0a69f8f...62.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e0c0a69f8f756b3ab1bc1bf2f5537dbb36a4057f5b1672729cd320d7ac343d62.exe

  • Size

    216KB

  • Sample

    240510-cd7q3acc8v

  • MD5

    35d15d8d64bf7e1f434106b50ae925ce

  • SHA1

    b0a43deb88658d2960acb63106bcc6c4e6c3740c

  • SHA256

    e0c0a69f8f756b3ab1bc1bf2f5537dbb36a4057f5b1672729cd320d7ac343d62

  • SHA512

    7bd55bc3cedea3ce5adbee8ab424f291136c128d4134646e9794221b0e52effe03fe695bb4523499a9e947593145977d3cb454f184046e3814a21f83b288705a

  • SSDEEP

    6144:9Akztmr9r/EDpppppppppppppppppppppppppppppb3:f5mr9r/+pppppppppppppppppppppppv

Score
10/10
zgratcollectionpersistenceratspywarestealer

Malware Config

Targets

    • Target

      e0c0a69f8f756b3ab1bc1bf2f5537dbb36a4057f5b1672729cd320d7ac343d62.exe

    • Size

      216KB

    • MD5

      35d15d8d64bf7e1f434106b50ae925ce

    • SHA1

      b0a43deb88658d2960acb63106bcc6c4e6c3740c

    • SHA256

      e0c0a69f8f756b3ab1bc1bf2f5537dbb36a4057f5b1672729cd320d7ac343d62

    • SHA512

      7bd55bc3cedea3ce5adbee8ab424f291136c128d4134646e9794221b0e52effe03fe695bb4523499a9e947593145977d3cb454f184046e3814a21f83b288705a

    • SSDEEP

      6144:9Akztmr9r/EDpppppppppppppppppppppppppppppb3:f5mr9r/+pppppppppppppppppppppppv

    Score
    10/10
    zgratcollectionpersistenceratspywarestealer

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks