Extracted

• • Target

    1f7512f7a6bf838034fed029aa56e843

  • Size

    1.4MB

  • MD5

    1f7512f7a6bf838034fed029aa56e843

  • SHA1

    b308c124f8e3bf19807680f36bd0990ab5c9693a

  • SHA256

    ee320b505f47ed1eaf6fd14b090b4a555e2c1b1cdba76a721c4d89598688ce1f

  • SHA512

    1ef1a4e684ed00e33b7c81a0be0a7d80c339deec8d1bae90c90fe0adbba5eaea68041e5f37d3859f84ca4fd75f33e61ae445bceb1b05fd023676a8c74bf2c6ce

  • SSDEEP

    12288:gz+7DBJg7Ef0CxVZmGNWR1/PL5RpBCDP6KsEEruB91pV+GS0r9Jj8Gx5IfVpeSQm:++XfcNTL0Qbp0nIsSEYf

  Score

  10^/10

  snakekeyloggerzgratkeyloggerratstealer

  • Detect ZGRat V1

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2