Extracted

Extracted

Extracted

• • Target

    DLL Injector Resou_nls..scr

  • Size

    571KB

  • MD5

    b6d15bc82d811c30d7e9633402bee9c2

  • SHA1

    c6fd47a1e8bb385bbce699d1e51b947e7fe780e2

  • SHA256

    8177a82bb9f46bb3a6b01b59eb6fbfc1bfebd9ba5147a5685ee49d6a9aa22002

  • SHA512

    fd76972ec643a9456d6612b96ca9eabd8ee23d9371d379777cc4cc7b7b31953e23373f60844a2559bea70cde86e72e55af2a052f1608aeb130fbbbf3033a860c

  • SSDEEP

    12288:o3ubKEsUNigEpgsI02qw67AjvhExMv3AO25aBcTA:aubKDgEpywweIAMohA

  Score

  10^/10

  upxasyncratzgrat441dwinlogoewwinlogoewgpersistenceratspywarestealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Async RAT payload

    rat

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2