Overview

overview

10

Static

static

1

e.rar

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e.rar

  • Size

    5.5MB

  • Sample

    240515-jlwr4afg83

  • MD5

    03a72a36ec1a2c7012b0518f93b86835

  • SHA1

    4d0b4b6307ff9206422be555d090f746d3038d2a

  • SHA256

    6be46618824bb0582789cfb6b37b80c9bb220079ea90cded22826ca68b35fa64

  • SHA512

    d1bc3b1871b85e756873d8b05a485f88b6ad7a2f2b242f71a525b2cab271f71f2e072204a63cae260d8febbef1d35c3b4aba44932b64f57db09075f8227a62b5

  • SSDEEP

    98304:ZtlOZm+7rK63WaQwzYgQWKBmwVTH3x+eKtiCmYnzFdnAXfVs2D8qCK:7lO8+vKUZxzUWKBmwdXxEiYnzUl8qCK

Score
10/10
zgratratspyware

Malware Config

Targets

    • Target

      e.rar

    • Size

      5.5MB

    • MD5

      03a72a36ec1a2c7012b0518f93b86835

    • SHA1

      4d0b4b6307ff9206422be555d090f746d3038d2a

    • SHA256

      6be46618824bb0582789cfb6b37b80c9bb220079ea90cded22826ca68b35fa64

    • SHA512

      d1bc3b1871b85e756873d8b05a485f88b6ad7a2f2b242f71a525b2cab271f71f2e072204a63cae260d8febbef1d35c3b4aba44932b64f57db09075f8227a62b5

    • SSDEEP

      98304:ZtlOZm+7rK63WaQwzYgQWKBmwVTH3x+eKtiCmYnzFdnAXfVs2D8qCK:7lO8+vKUZxzUWKBmwdXxEiYnzUl8qCK

    Score
    10/10
    zgratratspyware

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Executes dropped EXE

    • Loads dropped DLL

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks