zgrat

Target
Loader.exe
Size 347KB
Sample240513-1svbaafb7s
SHA256 c9c660914e4d58a6e0dd460afae6e4af288c9f191ad8592dc95db5a69868fc70
MD5 1cb742cb95699d994e1cc6810c6f7642
SHA1 103ea603322859742a3e51c5e517a927b9dcd40c
SHA512 79f9a70232b3470ef9386d9b3d987b5370d0562959315d8239509000a1aa9274b13cecc4c6c871cd4d258a0cd19d30574e3280edd54fb108b6ffca7d8c7e4795
SSDEEP 6144:RrwFDD0tZzmf7GxMLEYaEzE2d9JK5/J1pZKM35QM6KkfiruhbOuzB:Rg07e7seE2dK71rKu5Q6kfirIbOuF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  Loader.exe
- Size 347KB
- SHA256 c9c660914e4d58a6e0dd460afae6e4af288c9f191ad8592dc95db5a69868fc70
- MD5 1cb742cb95699d994e1cc6810c6f7642
- SHA1 103ea603322859742a3e51c5e517a927b9dcd40c
- SHA512 79f9a70232b3470ef9386d9b3d987b5370d0562959315d8239509000a1aa9274b13cecc4c6c871cd4d258a0cd19d30574e3280edd54fb108b6ffca7d8c7e4795
- SSDEEP 6144:RrwFDD0tZzmf7GxMLEYaEzE2d9JK5/J1pZKM35QM6KkfiruhbOuzB:Rg07e7seE2dK71rKu5Q6kfirIbOuF
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

zgrat evasion execution persistence rat spyware stealer
- Detect ZGRat V1
- Modifies WinLogon for persistence
  persistence
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Disables Task Manager via registry modification
  evasion
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2 behavioral3 behavioral4