zgrat

General

Target

updated.exe
Size

14.3MB
Sample

240514-esp6nsac8x
MD5

0ac2a69ee4ce6071a0fddd453ec9c780
SHA1

2c9e6f1183aa56dd08d1e49345c6d7a5094c13f7
SHA256

2d52c1f4a95db6bcad65d971a218e7b3b18a35e404e43fb53f340f635397e216
SHA512

f4f5c54303ef9eaae6e05844c6ca3c6f12ad7c259a71dc1f7e2a8bd8a05a5ba51459eb28905fcc25a1bcac6ebba66581b31abefad53ff5a56b37fee9b6bfe796
SSDEEP

393216:D3BAnExX5UULTyEg7AhubVYxhSYkm8EGZBeci0ldAVlI:DbxLTyzAhs0DVGZBe50A

Score

10^/10

Malware Config

Targets

- Target
  
  updated.exe
- Size
  
  14.3MB
- MD5
  
  0ac2a69ee4ce6071a0fddd453ec9c780
- SHA1
  
  2c9e6f1183aa56dd08d1e49345c6d7a5094c13f7
- SHA256
  
  2d52c1f4a95db6bcad65d971a218e7b3b18a35e404e43fb53f340f635397e216
- SHA512
  
  f4f5c54303ef9eaae6e05844c6ca3c6f12ad7c259a71dc1f7e2a8bd8a05a5ba51459eb28905fcc25a1bcac6ebba66581b31abefad53ff5a56b37fee9b6bfe796
- SSDEEP
  
  393216:D3BAnExX5UULTyEg7AhubVYxhSYkm8EGZBeci0ldAVlI:DbxLTyzAhs0DVGZBe50A
Score

10^/10

zgrat discovery evasion execution persistence rat spyware stealer
- Detect ZGRat V1
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information.
  execution
- Downloads MZ/PE file
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2