Overview

overview

10

Static

static

3

3f352445c5...9f.exe

windows7-x64

10

3f352445c5...9f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3f352445c521895812735acebb5f944cd1e88024cade5b201c562166619ffc9f.exe

  • Size

    594KB

  • Sample

    240514-bk1ewsdf86

  • MD5

    f5fe6435df7702338b1320b55f96caa4

  • SHA1

    fab2bbc6e43cc01217673b2753e223099c3c297f

  • SHA256

    3f352445c521895812735acebb5f944cd1e88024cade5b201c562166619ffc9f

  • SHA512

    4c355979435dc7519c4e4ee1a9ff6ad4be9cabcaa6b376473b039fcd785837689f16662e680b196f2b74ec689ff894175a2892206f1883e6e22ca89a292a6fab

  • SSDEEP

    12288:Ta+kA8UkbVvyhzR8OQtgR64Hh4oPRSviJFwuHnOr387dPex:FFgkh21gR3JSviJFbnOz87dPe

Score
10/10
zgratagilenetexecutionrat

Malware Config

Targets

    • Target

      3f352445c521895812735acebb5f944cd1e88024cade5b201c562166619ffc9f.exe

    • Size

      594KB

    • MD5

      f5fe6435df7702338b1320b55f96caa4

    • SHA1

      fab2bbc6e43cc01217673b2753e223099c3c297f

    • SHA256

      3f352445c521895812735acebb5f944cd1e88024cade5b201c562166619ffc9f

    • SHA512

      4c355979435dc7519c4e4ee1a9ff6ad4be9cabcaa6b376473b039fcd785837689f16662e680b196f2b74ec689ff894175a2892206f1883e6e22ca89a292a6fab

    • SSDEEP

      12288:Ta+kA8UkbVvyhzR8OQtgR64Hh4oPRSviJFwuHnOr387dPex:FFgkh21gR3JSviJFbnOz87dPe

    Score
    10/10
    zgratagilenetexecutionrat

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Detects executables packed with Agile.NET / CliSecure

    • Downloads MZ/PE file

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks