zgrat | 52023b5bef184dd2d797d7263d2d2fc3_JaffaCakes118 | Triage

Sharing

General

Target

52023b5bef184dd2d797d7263d2d2fc3_JaffaCakes118
Size

1.3MB
MD5

52023b5bef184dd2d797d7263d2d2fc3
SHA1

f3acec18ab64edb79c9882e05f4aaaca1be223a3
SHA256

e0b69eb31cb55ed63d3c72cf163bb4b1a169a0667de55c7bad34380b64c17a1e
SHA512

26cdb2c0ffb2222245e285322a464a21f48e4782b3cc8ff4dc9cedbd25c50abfd0f042b90c72c87adb41e3c31a8195613bd93c62c0860eccd5fcd0e91a4a54f1
SSDEEP

24576:4eHaEpawVp/IG968tWeySr3eVJ99W+h7puz2PV:4C/36YWRSr3Ac+hTV

Score

10^/10

zgrat

Malware Config

Signatures

Detect ZGRat V2 1 IoCs

resource	yara_rule
sample	family_zgrat_v2

Zgrat family
zgrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
52023b5bef184dd2d797d7263d2d2fc3_JaffaCakes118

Files

52023b5bef184dd2d797d7263d2d2fc3_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 921KB - Virtual size: 920KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 363KB - Virtual size: 363KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ