Overview

overview

10

Static

static

3

3b7803f373...18.exe

windows7-x64

10

3b7803f373...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3b7803f3730b86abbe827b0ae88d44df_JaffaCakes118

  • Size

    738KB

  • Sample

    240512-wz5y5saa81

  • MD5

    3b7803f3730b86abbe827b0ae88d44df

  • SHA1

    f29c58ba2a56cb6a19bea3ee434f43c8e5fac629

  • SHA256

    6e6b496b643a1e50d59c86e3a0723251c719e8ed8e4858ac9d82c94cc2606c1e

  • SHA512

    1c899f344b6d881d18adf6a363e18197d2468d8c8145f23cedb99d5e0baf016c95f4302272decaaddd78c5491b0becfae4097db866c7c07ce17906854bc47875

  • SSDEEP

    12288:+Wf2WJ7cTgYRncDp1cFEgCqfVThAKtGw4q985Lo5hNpqK:+07cdRncDpe6gCqfphpGw4qK5L

Score
10/10
imminentzgratagilenetpersistenceratspywaretrojan

Malware Config

Targets

    • Target

      3b7803f3730b86abbe827b0ae88d44df_JaffaCakes118

    • Size

      738KB

    • MD5

      3b7803f3730b86abbe827b0ae88d44df

    • SHA1

      f29c58ba2a56cb6a19bea3ee434f43c8e5fac629

    • SHA256

      6e6b496b643a1e50d59c86e3a0723251c719e8ed8e4858ac9d82c94cc2606c1e

    • SHA512

      1c899f344b6d881d18adf6a363e18197d2468d8c8145f23cedb99d5e0baf016c95f4302272decaaddd78c5491b0becfae4097db866c7c07ce17906854bc47875

    • SSDEEP

      12288:+Wf2WJ7cTgYRncDp1cFEgCqfVThAKtGw4q985Lo5hNpqK:+07cdRncDpe6gCqfphpGw4qK5L

    Score
    10/10
    imminentzgratagilenetpersistenceratspywaretrojan

    • Detect ZGRat V1

    • Imminent RAT

      Remote-access trojan based on Imminent Monitor remote admin software.

      trojanspywareimminent

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks