Behavioral task
behavioral1
Sample
b1e9219d3ae46d1a9dfde452e0454770a6db9e91e00c786f6dca66ebd8b72557.exe
Resource
win7-20231129-en
General
-
Target
b1e9219d3ae46d1a9dfde452e0454770a6db9e91e00c786f6dca66ebd8b72557
-
Size
1.4MB
-
MD5
37e174390b827511ca7f203c4bafc85d
-
SHA1
4c925c961be54bd5c68b7b91417d52d0128ad5f7
-
SHA256
b1e9219d3ae46d1a9dfde452e0454770a6db9e91e00c786f6dca66ebd8b72557
-
SHA512
d4669e3229b6663804a7d7720c5383b0051379e89e40f016bfba1aafdbc6c6b2d18a2b03e311c298c67cd9a6796bb5184e736f963b69851efc40e40407327021
-
SSDEEP
24576:yVr2LnLUrHpRfZDx41Ft8RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRd:yVbxHjQHKgraQ2DmtWb
Malware Config
Signatures
-
Detect ZGRat V2 1 IoCs
Processes:
resource yara_rule sample family_zgrat_v2 -
Zgrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource b1e9219d3ae46d1a9dfde452e0454770a6db9e91e00c786f6dca66ebd8b72557
Files
-
b1e9219d3ae46d1a9dfde452e0454770a6db9e91e00c786f6dca66ebd8b72557.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 281KB - Virtual size: 280KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ