Overview

overview

10

Static

static

3

8edf194ebe...59.exe

windows7-x64

10

8edf194ebe...59.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8edf194ebe43881996616dc08ce1c828a59b51d312715b43e155af0e59484159.exe

  • Size

    1.4MB

  • Sample

    240512-ky9edscc44

  • MD5

    61f11bde1f33ddb5b4c398d4cc8b1c7c

  • SHA1

    614eaeab2931cc5b18f4d09afdf18fa95948ed90

  • SHA256

    8edf194ebe43881996616dc08ce1c828a59b51d312715b43e155af0e59484159

  • SHA512

    a2c33d12d345987be7cb2f53d321e738dd7b2b85672f674c317405313be4b3f13bfa99e9a0cda37b59563734871f299db33964a4576ee2a6e23e0dbdc7fab708

  • SSDEEP

    24576:mj/Vhz2r7o+CE7cBOlZqevIhEvQQdFZUQpCqoIpO8TI76ze7lyJD5xKeVwGvn:q/Pz2rkzEYBOGGIsdFZUQpbVTIiEqD5Z

Score
10/10
zgratevasionexecutionpersistencerat

Malware Config

Targets

    • Target

      8edf194ebe43881996616dc08ce1c828a59b51d312715b43e155af0e59484159.exe

    • Size

      1.4MB

    • MD5

      61f11bde1f33ddb5b4c398d4cc8b1c7c

    • SHA1

      614eaeab2931cc5b18f4d09afdf18fa95948ed90

    • SHA256

      8edf194ebe43881996616dc08ce1c828a59b51d312715b43e155af0e59484159

    • SHA512

      a2c33d12d345987be7cb2f53d321e738dd7b2b85672f674c317405313be4b3f13bfa99e9a0cda37b59563734871f299db33964a4576ee2a6e23e0dbdc7fab708

    • SSDEEP

      24576:mj/Vhz2r7o+CE7cBOlZqevIhEvQQdFZUQpCqoIpO8TI76ze7lyJD5xKeVwGvn:q/Pz2rkzEYBOGGIsdFZUQpbVTIiEqD5Z

    Score
    10/10
    zgratevasionexecutionpersistencerat

    • Detect ZGRat V1

    • Modifies WinLogon for persistence

      persistence

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Disables Task Manager via registry modification

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks