Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    61afab1517020d59a2db1eaf174cc1acf1a59af7a8515a1b5ea3a0d10a8eac60

  • Size

    1.7MB

  • MD5

    ed023543b40e9ebaf6cb40da28074173

  • SHA1

    986bd1989695ea88b503f7e40958a17b5c635b0e

  • SHA256

    61afab1517020d59a2db1eaf174cc1acf1a59af7a8515a1b5ea3a0d10a8eac60

  • SHA512

    75629fcd087df7197ff678a1d8b165774486e84129df26ac2ad40f1654804cb043f31816650c74d62252286e9a4644edf54216322c99e68161900957ca180b59

  • SSDEEP

    49152:M/pGRzjjMoZ0NmuCBdOMYVcbCD23Eflux69AJe:qpIEmZUT2Wjm2

  Score

  10^/10

  eternityprivateloaderredlineriseprosmokeloaderzgrat@ytlogsbothordalivetrafficbackdoorinfostealerloaderpersistenceratstealertrojan

  • Detect ZGRat V1

  • Eternity

    Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.

    eternity

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Downloads MZ/PE file

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1