Overview

overview

10

Static

static

3

133fda00a4...eb.exe

windows7-x64

10

133fda00a4...eb.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    133fda00a490e613f3a6c511c1c660eb.exe

  • Size

    4.5MB

  • Sample

    240515-bq8nfsab3w

  • MD5

    133fda00a490e613f3a6c511c1c660eb

  • SHA1

    e34f9f1c622a7e6d3cb34217b0935ebdaab8ebe9

  • SHA256

    cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169

  • SHA512

    f4dd02b04326e37a3368d9c385b363689f877ae43c16de103efada642f41fe85580939db84a030597e3032d6da407d073af2b64160feec6fe38f37f1b473fffd

  • SSDEEP

    24576:ypPiRcjGOOiX3Sl9L7MupXdagdle6whTeo5A4T9W+xjaCsyfwUmvHX+ODvz8JQDm:

Score
10/10
zgratevasionrat

Malware Config

Targets

    • Target

      133fda00a490e613f3a6c511c1c660eb.exe

    • Size

      4.5MB

    • MD5

      133fda00a490e613f3a6c511c1c660eb

    • SHA1

      e34f9f1c622a7e6d3cb34217b0935ebdaab8ebe9

    • SHA256

      cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169

    • SHA512

      f4dd02b04326e37a3368d9c385b363689f877ae43c16de103efada642f41fe85580939db84a030597e3032d6da407d073af2b64160feec6fe38f37f1b473fffd

    • SSDEEP

      24576:ypPiRcjGOOiX3Sl9L7MupXdagdle6whTeo5A4T9W+xjaCsyfwUmvHX+ODvz8JQDm:

    Score
    10/10
    zgratevasionrat

    • Detect ZGRat V1

    • Modifies security service

      evasion

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks