Extracted

• • Target

    a19d26160936d45993c7f51ba45422efadefe03ff3819e28ff52482334fa65c3

  • Size

    916KB

  • MD5

    b2e2f7e938326213778c21bac8a07b0c

  • SHA1

    0e2e02c20665b2b7a0f700b31a9f8c80e736f3f4

  • SHA256

    a19d26160936d45993c7f51ba45422efadefe03ff3819e28ff52482334fa65c3

  • SHA512

    0f50989152c77eff1dc80e63d3e83a8818db1b0d67653a102be631c32edc4c2799c7656040761a18210a1353ce436ca852a7ff629f4a0920b5603a77a866f906

  • SSDEEP

    24576:5Ru+5TGtOR/f/MtTU7Qv2Q1QRTT3GQqReCxY/Bc:57TG4/H6OQ1g3GQvw

  Score

  10^/10

  purecrypterzgratdownloaderloaderrat

  • Detect ZGRat V1

  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

    loaderdownloaderpurecrypter

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1