Overview

overview

10

Static

static

1

65.exe

windows7-x64

10

65.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    65.exe

  • Size

    1.9MB

  • Sample

    241025-kp3v9ayckr

  • MD5

    289d61c6e3b5f6592f6d246abf213b2a

  • SHA1

    ba01cb12f4aa2f724d2ba31951fc10eb4fc9f186

  • SHA256

    377583a5e31d2b6953ea0955f149a2e9fe134ae420c3d91aab07adeeae728fcd

  • SHA512

    fb8eb1a50435af924e5003e6985724b27bdf3d2f496716e37d8a37ddc8fbf7eafca8c623ad2eb9473f16c799f278270e16416b9a8d63df2101d21414423f12a0

  • SSDEEP

    49152:d7bdYAm4zKbdYAm4zSs5XbdYAm4zabdYAm4zK6c5UQ33W/T62Ty:ddrAdrZrdrwdrV4Uu3ue2G

Score
10/10
zgratdiscoveryratspywarestealer

Malware Config

Targets

    • Target

      65.exe

    • Size

      1.9MB

    • MD5

      289d61c6e3b5f6592f6d246abf213b2a

    • SHA1

      ba01cb12f4aa2f724d2ba31951fc10eb4fc9f186

    • SHA256

      377583a5e31d2b6953ea0955f149a2e9fe134ae420c3d91aab07adeeae728fcd

    • SHA512

      fb8eb1a50435af924e5003e6985724b27bdf3d2f496716e37d8a37ddc8fbf7eafca8c623ad2eb9473f16c799f278270e16416b9a8d63df2101d21414423f12a0

    • SSDEEP

      49152:d7bdYAm4zKbdYAm4zSs5XbdYAm4zabdYAm4zK6c5UQ33W/T62Ty:ddrAdrZrdrwdrV4Uu3ue2G

    Score
    10/10
    zgratdiscoveryratspywarestealer

    • Detect ZGRat V2

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks