Extracted

• • Target

    d030ec06a1d021fb435d8459a929db7b

  • Size

    731KB

  • MD5

    d030ec06a1d021fb435d8459a929db7b

  • SHA1

    155e20d350f9d2223bdd9c5dc30ad2969f077487

  • SHA256

    cf53005d2d146dadf6dc95287bbcd1a50c8687711ebf8d497535f14ae423d6c3

  • SHA512

    f46a8fd4016911c8bea1c579b89899173d65e019d8caae6ada6bac52d4a85ee734294b9622ce762d255fb0c6903e1040b33fdc71fecffd8d70ec225624b07786

  • SSDEEP

    12288:aPOlblXqp28GxW8ULUwC5Y/pT2UZI2PvSSR0o6y2/:aUtqpDCHU4MpT2UVPvSSR0o6y2

  Score

  10^/10

  xloaderzgratu6f4loaderrat

  • Detect ZGRat V1

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Xloader payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2