Overview

overview

10

Static

static

3

Loader.exe

windows7-x64

3

Loader.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Loader.zip

  • Size

    6.1MB

  • Sample

    250326-wbv42azvex

  • MD5

    42bf549528ac19ef8d1f1b0987789738

  • SHA1

    0ccc5ba4d201591b7ebba2ad7e4bc76bb8260979

  • SHA256

    d5898de95b6043b5b8297cc70ab57b8c5f9108522427613d72ae6a535fdce603

  • SHA512

    9eb456abe305f274e84d6061a072e8403c7cea14aa92da9fa577570567d0ff83f9ba12e2ebea522406b3921ce4e74845c6bc1622747b3a14049b38d6006af3e3

  • SSDEEP

    98304:16+++fTfdc+w+bQMkKauBOrA+R0z45dQpXIjKxxZSQ9ksVYt/BZhKhjJCf:16qtwoVkK9k6sUoKbZSXt/BZhKhjJCf

Score
10/10
zgratdiscoveryrat

Malware Config

Targets

    • Target

      Loader.exe

    • Size

      16.1MB

    • MD5

      c22a5f16e633b070f821498f180ab0cc

    • SHA1

      c1c9ede5381a453c1407c2054fc6257add2ac0d3

    • SHA256

      57a1106223ddd9f1cd1668e1ceb67d909859fd024c1cd97d3a67cef203313341

    • SHA512

      ff8cd898824da7026220eaf8e89ddeff6477087679fc7c97778a34b612ab917013c00ccc487efc07801cb8ccd359389a2170a323586ed69f896b2e3c267a893a

    • SSDEEP

      196608:3rmOg8g5aoZnyFd36mwSv4Z0ZX+3NFaAMROyGoi:aOg8zcs37wQ4zvaAMROyi

    Score
    10/10
    discoveryzgratrat

    • Detect ZGRat V2

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Zgrat family

      zgrat

    • Loads dropped DLL

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks