Extracted

• • Target

    Orden de Compra##.xla.xlsx

  • Size

    101KB

  • MD5

    1024a690a0cdbf2505121b0d14b70125

  • SHA1

    a048b94a8ae9251b61e3348438ff0f3f2c89b33a

  • SHA256

    0a7523a33dbf8a15afdcef5a7efbaf4a2ed53706c8b0daad1ad8c69962180566

  • SHA512

    7ec14256710b048c69bbd0ccb80a5ea9333ad5fe6e106509dcd62885fb15cae3217102633d0006325d7aadd2ba1b974d24e6599ee74f804b9c6805c51e3d1a5a

  • SSDEEP

    1536:lpQDZbuylO9AKt9+CASVnmLIMPXHI8d+xpgFlIoOcbF6KUHJHuJPMIdTd:8Vyy1Kt0GdmBP3I8MgnIPwFtWHIP

  Score

  10^/10

  zgratrat

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Blocklisted process makes network request

  • Abuses OpenXML format to download file from external location

  • Drops file in System32 directory

  behavioral1behavioral2