zgrat | 2a173059e9f7d1147a60ebf89e4991592d55d66b551ec9a89397eabf1b0b8bfd | Triage

Analysis

max time kernel
24s
max time network
24s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13-05-2024 23:02

Sharing

Report Analysis Logs

General

Target

Paypal Receipt Generator.exe
Size

355KB
MD5

81dc2cf4677a380a4572f61a14cd204c
SHA1

3a4d5b396cdf3c560159792a8608f934d44ee1b1
SHA256

2a173059e9f7d1147a60ebf89e4991592d55d66b551ec9a89397eabf1b0b8bfd
SHA512

20ec7ab40301bf858dd2b49fe22a3342b31960c21f897ab4d967454dae018b15ccfc8bccc6579354017319605ecdad15cb77afe9e59559ec0af41bf021c491fa
SSDEEP

6144:ElFhgyS7ovkgfyIUcVq1/U4OpTqUlqIWIVehKRy+zAaS:iyaHUH/PTP0Ry+E

Score

10^/10

zgrat rat

Malware Config

Signatures

Detect ZGRat V1 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1964-1-0x0000000000760000-0x00000000007C0000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

Processes:

resource	yara_rule
behavioral2/memory/1964-1-0x0000000000760000-0x00000000007C0000-memory.dmp	net_reactor

C:\Users\Admin\AppData\Local\Temp\Paypal Receipt Generator.exe
"C:\Users\Admin\AppData\Local\Temp\Paypal Receipt Generator.exe"
1⤵
PID:1964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1964-0-0x0000000074EEE000-0x0000000074EEF000-memory.dmp

Filesize
4KB

Download
memory/1964-1-0x0000000000760000-0x00000000007C0000-memory.dmp

Filesize
384KB

Download