zgrat | Oski Cracked[.]exe | Triage

Sharing

General

Target

Oski Cracked.exe
Size

4.7MB
MD5

fae4c2fc795b054c80d57ad600f8447f
SHA1

94ef84328a4c1c864307870d8e98cc4b6d334dd5
SHA256

579e9d2e534610d36fa6073b825f8caffc41f1f20dad0cfd1749ca12d202a11c
SHA512

35da6d3abc97cea70fb573d45f5bd528f5550d478a464f40dd1455f453c65a16283d3a5106aa9e488d3674db5d0ec7009a0cfd30d026afc4220e829f32075be9
SSDEEP

98304:PahEJCbuSMburCaMZh0yEKj+WRvrY1dcZ048HV/bFy8jJ7LUdVmi:PahmmMbuQZlFY7KsZPNLUdQ

Score

10^/10

zgrat

Malware Config

Signatures

Detect ZGRat V1 1 IoCs

resource	yara_rule
sample	family_zgrat_v1

Zgrat family
zgrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Oski Cracked.exe

Files

Oski Cracked.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 4.6MB - Virtual size: 4.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 1024B - Virtual size: 744B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ