zgrat | 01598af6a70a105d03e7759fef28f580_NeikiAnalytics | Triage

Sharing

General

Target

01598af6a70a105d03e7759fef28f580_NeikiAnalytics
Size

337KB
MD5

01598af6a70a105d03e7759fef28f580
SHA1

062acc53741d0aa41c3b5db443bdfcf8b1024690
SHA256

affa3dfd1f5a12c36dc46f95339fad0be78922aba6f27775da779b33fc4ad09e
SHA512

87f0431e4a63287b8bb6441f1a1fc2b45ff1b00df07248ae0e7951ca11e4e16c7e6505e249af32406c91b5b1059b3211f11b97fa6df1ae2aee7d9f146bbfdd87
SSDEEP

6144:N13ux89dP66zqTyRYD2K5CvUr1PbGo74xvVNqY0DX:Sx89EpDD2K5OUBPwNwZ

Score

10^/10

zgrat

Malware Config

Signatures

Detect ZGRat V1 1 IoCs

resource	yara_rule
sample	family_zgrat_v1

Zgrat family
zgrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
01598af6a70a105d03e7759fef28f580_NeikiAnalytics

Files

01598af6a70a105d03e7759fef28f580_NeikiAnalytics
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 331KB - Virtual size: 330KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ