Overview

overview

10

Static

static

10

fd20c43c25...c8.exe

windows7-x64

9

fd20c43c25...c8.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fd20c43c250724b2fa1ce40b7edc6e8616f6a63573da5b04fd87a307b02333c8.exe

  • Size

    73KB

  • Sample

    240511-cgy84ahg95

  • MD5

    bad18478169b1e5d1a4e9f55a105bc94

  • SHA1

    acd5a2f2a4d386b35d68be8c0aa6f19bbe01b8f4

  • SHA256

    fd20c43c250724b2fa1ce40b7edc6e8616f6a63573da5b04fd87a307b02333c8

  • SHA512

    66d24b16442b61666c0d57464d1ecbd70089094a24a91a75c11f95a79b23440012e6ec74aed32f27b9b63494b0d513b82d11fd9d234be28a6f986b8bf3aa41a0

  • SSDEEP

    1536:KcHADLysy+7f1CEqJ+VLTeNhmZpfmd/PqiDf075Eeii:5ADmsy49xLTw+8qM25r/

Score
10/10
zgratcollectionratspywarestealer

Malware Config

Targets

    • Target

      fd20c43c250724b2fa1ce40b7edc6e8616f6a63573da5b04fd87a307b02333c8.exe

    • Size

      73KB

    • MD5

      bad18478169b1e5d1a4e9f55a105bc94

    • SHA1

      acd5a2f2a4d386b35d68be8c0aa6f19bbe01b8f4

    • SHA256

      fd20c43c250724b2fa1ce40b7edc6e8616f6a63573da5b04fd87a307b02333c8

    • SHA512

      66d24b16442b61666c0d57464d1ecbd70089094a24a91a75c11f95a79b23440012e6ec74aed32f27b9b63494b0d513b82d11fd9d234be28a6f986b8bf3aa41a0

    • SSDEEP

      1536:KcHADLysy+7f1CEqJ+VLTeNhmZpfmd/PqiDf075Eeii:5ADmsy49xLTw+8qM25r/

    Score
    10/10
    zgratcollectionratspywarestealer

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Detects executables packed with SmartAssembly

    • Drops startup file

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks