Overview

overview

10

Static

static

3

04fe72c721...e9.zip

windows7-x64

1

04fe72c721...e9.zip

windows10-2004-x64

1

NEW ORDER ...ON.scr

windows7-x64

10

NEW ORDER ...ON.scr

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    NEW ORDER CONFIRMATION.zip.zip
  • Size 2.9MB
  • Sample240510-khdmsagc69
  • SHA256 1b9ba67d4a203183fb845772c3edb45c98db044809a23c7762134f111fbc0a32
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
zgratcollectionrat

Malware Config

Targets

    • Target
      04fe72c7211de060e7f25a1f6b7e30fd2760b983cf7251d0f11b4a4b01b588e9
    • Size 2.9MB
    • SHA256 04fe72c7211de060e7f25a1f6b7e30fd2760b983cf7251d0f11b4a4b01b588e9
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral1behavioral2
    • Target
      NEW ORDER CONFIRMATION.scr
    • Size 3.0MB
    • SHA256 ba58f8ba7420adb8ffa2c999e7b20c1958d353c1146cb5eff41b5057f320f7be
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    zgratcollectionrat

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks