Extracted

Extracted

Extracted

• • Target

    c0db49a39e6aaa5e8b9480720857b7f3ca44e2de5cf2e8b24baa7bedc21a7e40

  • Size

    552KB

  • MD5

    a94ebe341ce9c684ff4b51a0553152bc

  • SHA1

    a557a208f737fbefe2e46dcb9ec19b4e05f9ed44

  • SHA256

    c0db49a39e6aaa5e8b9480720857b7f3ca44e2de5cf2e8b24baa7bedc21a7e40

  • SHA512

    02e0ba385a45ad393be1b2e0b716e1cd1c6c9b62a194e909ad17c99db79e89bf05294661d29153d222730e17392b8114e85516df54147a71b9d5fdee0da769ab

  • SSDEEP

    12288:DMr1y90j0NA0H7Gae/4IC50pCCHGN0PLvYMXiYQbDL6jO:2yKiaaewIsgCQGIgYDFO

  Score

  10^/10

  gluptebaredlinesectopratsmokeloaderzgratpixelnew2.0up3backdoorgoogledropperinfostealerloaderpersistencephishingrattrojan

  • Detect ZGRat V1

  • Detected google phishing page

    phishinggoogle

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba

  • Glupteba payload

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  behavioral1