Overview

overview

10

Static

static

10

YT#payment...11.exe

windows7-x64

9

YT#payment...11.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    96b67999e3f0a8105cc90ad4fc2180b0bf2137ff7d0ce11d894b122be307decf.gz
  • Size 35KB
  • Sample240511-b4rxvsec2w
  • SHA256 96b67999e3f0a8105cc90ad4fc2180b0bf2137ff7d0ce11d894b122be307decf
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
zgratcollectionratspywarestealer

Malware Config

Targets

    • Target
      YT#payment_705427_82908_04321_983653_37510_0975211.exe
    • Size 73KB
    • SHA256 fd20c43c250724b2fa1ce40b7edc6e8616f6a63573da5b04fd87a307b02333c8
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    zgratcollectionratspywarestealer

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Detects executables packed with SmartAssembly

    • Drops startup file

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks