zgrat | IPTVCheckerv210[.]exe | Triage

Sharing

General

Target

IPTVCheckerv210.exe
Size

6.5MB
MD5

57ac6b3c5eab44eb04e943166072d3de
SHA1

50fb80d2ebcbd5f111cfa6308bd3835a013ba41a
SHA256

c17efa57565d97c75937d7587c9b56f58d9bf7d10d9c94cc032588e119baf545
SHA512

51a4d94362e53ddcf6a41d43dc9a593082a8f524950116c395368c024030128d818fbeee2825b8ea18b0c3c4cc2a0bbcb8f053457b87df7de9da956f8eecdcbe
SSDEEP

196608:T0LKDnJ45/9iD54+V11bFv4z9dR6Dlp2l:fuR6Dlp2l

Score

10^/10

zgrat

Malware Config

Signatures

Detect ZGRat V1 1 IoCs

resource	yara_rule
sample	family_zgrat_v1

Zgrat family
zgrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
IPTVCheckerv210.exe

Files

IPTVCheckerv210.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

IPTV Checker 2.0.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 6.4MB - Virtual size: 6.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 108KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ