General
-
Target
Synapse.exe
-
Size
17.5MB
-
Sample
240512-ezqqsabe56
-
MD5
0c015a50850cec3d831b97980180b73b
-
SHA1
3a95c7334e446975d3d22a753075f4941a00177c
-
SHA256
fb025a0aa34315c3287c087cc598598732f8e96cbcba4cd5ea2d728a270e5467
-
SHA512
47f49f646f0141f0f5cba08269ef3780f2e1d85707f32b94c363c208af827b82c0e1d98355da1e0240cb93eca6d3337b382db84a549ba93759bb719383eb2e84
-
SSDEEP
393216:pv90+5gDTj5L1V8dXurEUWjsrfTbEkPKkvbuK+x:l9PkNRkdb8fTbIkSK+
Malware Config
Targets
-
-
Target
Synapse.exe
-
Size
17.5MB
-
MD5
0c015a50850cec3d831b97980180b73b
-
SHA1
3a95c7334e446975d3d22a753075f4941a00177c
-
SHA256
fb025a0aa34315c3287c087cc598598732f8e96cbcba4cd5ea2d728a270e5467
-
SHA512
47f49f646f0141f0f5cba08269ef3780f2e1d85707f32b94c363c208af827b82c0e1d98355da1e0240cb93eca6d3337b382db84a549ba93759bb719383eb2e84
-
SSDEEP
393216:pv90+5gDTj5L1V8dXurEUWjsrfTbEkPKkvbuK+x:l9PkNRkdb8fTbIkSK+
Score10/10-
Detect ZGRat V1
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Checks for common network interception software
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Downloads MZ/PE file
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-