Overview

overview

10

Static

static

3

Dhl.exe

windows7-x64

1

Dhl.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8e3b61a64a6e802cdf9f926deaf040a808ebe5222e0a7a06f578e2376c42104f.img

  • Size

    268KB

  • Sample

    240511-b2yydsgf65

  • MD5

    4d4e1f532333c34574f5cffc1079ab9b

  • SHA1

    25a4b16dec3d210477328151187c4372827cbe34

  • SHA256

    8e3b61a64a6e802cdf9f926deaf040a808ebe5222e0a7a06f578e2376c42104f

  • SHA512

    e7a210856615bdaee987e46ff7dd1b412602d6d4e19a4c983473b3ea019ddc9337ee9cdff02e7b05c3b9da552c6043d0b354cb87553d006d5e01ab48a2d83c3d

  • SSDEEP

    6144:dAkztmr9r/EDpppppppppppppppppppppppppppppb3:/5mr9r/+pppppppppppppppppppppppv

Score
10/10
zgratpersistenceratspywarestealer

Malware Config

Targets

    • Target

      Dhl.exe

    • Size

      216KB

    • MD5

      35d15d8d64bf7e1f434106b50ae925ce

    • SHA1

      b0a43deb88658d2960acb63106bcc6c4e6c3740c

    • SHA256

      e0c0a69f8f756b3ab1bc1bf2f5537dbb36a4057f5b1672729cd320d7ac343d62

    • SHA512

      7bd55bc3cedea3ce5adbee8ab424f291136c128d4134646e9794221b0e52effe03fe695bb4523499a9e947593145977d3cb454f184046e3814a21f83b288705a

    • SSDEEP

      6144:9Akztmr9r/EDpppppppppppppppppppppppppppppb3:f5mr9r/+pppppppppppppppppppppppv

    Score
    10/10
    zgratpersistenceratspywarestealer

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks