Overview

overview

10

Static

static

10

132ef1a933...c3.exe

windows7-x64

10

132ef1a933...c3.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7b98c1a55e4da595629c9d2f0b507a06fb0b576356d5621603040913b2e8a197

  • Size

    2.1MB

  • Sample

    240514-rxte4sbc85

  • MD5

    dd67e11474fa72e97d78c8852641e9c9

  • SHA1

    d9ce7482dd3ed1f2c9ca3a6a1484c9c2e490b98f

  • SHA256

    7b98c1a55e4da595629c9d2f0b507a06fb0b576356d5621603040913b2e8a197

  • SHA512

    0e3c137728783b09d4b557c3834db514530c2c4735a7c76bca719de08848ee7810326c0e2d68b0c4069290efe5606d5e54c42cb49125baf56589fe350e8c7190

  • SSDEEP

    49152:ABB1lp4kFYRZ/tu/eJfLu03z88bW//c0S5eYEkHEoex3O:ABblp4kFM/tgUf6EbP0SHFVex3O

Score
10/10
zgratransomwareratspywarestealer

Malware Config

Targets

    • Target

      132ef1a933f9d26fb0bb46b0a970dbfe05ad8fe0859ece8eb973b5584a580cc3.exe

    • Size

      2.6MB

    • MD5

      71f0e2645d9051c3a8f5cf2dbce9d074

    • SHA1

      a303632965f9fdc3b7cb4c532831c0b38f24df90

    • SHA256

      132ef1a933f9d26fb0bb46b0a970dbfe05ad8fe0859ece8eb973b5584a580cc3

    • SHA512

      14625c8fe238a41c0a45579731a15a705f153681a0f4e212b8315e3f5643542c57e17f82c247552b21417aa92dce36fd40fbcaaf85b4fb462182c2814f4f8077

    • SSDEEP

      49152:Til/s9YkCKuT/s9YEQtQRTMYIMi7ztf33cSywWyFoEgn9u:OVsGkClzsG1tQRjdih8rwc

    Score
    10/10
    zgratransomwareratspywarestealer

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • .NET Reactor proctector

      Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Defacement

1
T1491

Resource Development

Reconnaissance

Tasks