Overview

overview

10

Static

static

3

d24ce40c44...18.exe

windows7-x64

10

d24ce40c44...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d24ce40c44d17bb1a14c38637cff3199_JaffaCakes118

  • Size

    2.2MB

  • Sample

    240907-tcw2ls1frq

  • MD5

    d24ce40c44d17bb1a14c38637cff3199

  • SHA1

    cadab087e9630d0e39637f0861d137575de08264

  • SHA256

    411e5de40815fe6cd8b72dac4981a3accb8eb37e3c8dd782986df3d5cfaff9ce

  • SHA512

    ae20e135c0c6bafe6b900ae7e9095e661ceee38a7e35855c8f90e0e53424fa581712c03f89d8c2be8c8ef67c68c779d0e8888e8e21189104d7d3098a282e264b

  • SSDEEP

    49152:c2+thjVnoULHUO/Xy4KRz2kPkxY5mGLAH5gbJhmMNsQXte2HJo1k/r+:jZU7VCPs8MH5GhmAswtVB

Score
10/10
zgratdiscoveryevasionrat

Malware Config

Targets

    • Target

      d24ce40c44d17bb1a14c38637cff3199_JaffaCakes118

    • Size

      2.2MB

    • MD5

      d24ce40c44d17bb1a14c38637cff3199

    • SHA1

      cadab087e9630d0e39637f0861d137575de08264

    • SHA256

      411e5de40815fe6cd8b72dac4981a3accb8eb37e3c8dd782986df3d5cfaff9ce

    • SHA512

      ae20e135c0c6bafe6b900ae7e9095e661ceee38a7e35855c8f90e0e53424fa581712c03f89d8c2be8c8ef67c68c779d0e8888e8e21189104d7d3098a282e264b

    • SSDEEP

      49152:c2+thjVnoULHUO/Xy4KRz2kPkxY5mGLAH5gbJhmMNsQXte2HJo1k/r+:jZU7VCPs8MH5GhmAswtVB

    Score
    10/10
    zgratdiscoveryevasionrat

    • Detect ZGRat V2

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks