Extracted

• • Target

    U1su8hmVj4ourFo.exe

  • Size

    696KB

  • MD5

    6948d3ae7ef630dd997b7d09e17159a0

  • SHA1

    f22729b5b442119a1de75e12af90e3d97a1de68c

  • SHA256

    b8c9a4161e9621de6e7fa177230bd3841a575a00f0456b54efab368046479722

  • SHA512

    a11f351dd83dcb96485ae834085f28eb740b3295dbaa550acb717b0084a0a6cff9568a5084f7b690edea2c4f537ced85185d5735618bcebce993656f751cb751

  • SSDEEP

    12288:6p11OhPAWlfRexM/YUPH6NFusNkmXuQcKyHQu:6O5AWlfRAFNMSMQcKBu

  Score

  10^/10

  snakekeyloggerzgratkeyloggerratstealer

  • Detect ZGRat V1

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2