Extracted

• • Target

    08823197d8b40df8b8926f8e7720d84d

  • Size

    499KB

  • MD5

    08823197d8b40df8b8926f8e7720d84d

  • SHA1

    1bb7458dff5b33c00baccee1f1f3b592c514e75b

  • SHA256

    54c07a8dbda4527039a17994432efc6ad9e56d0c305694d33f60f1ce7c26b507

  • SHA512

    268121dc717f233ecf59bb00caa664003aeede4e841cc8583fa3d5343b6340bd439c7d8ea1eb3467612e830bdcf3e0953f2d807a05091cee0574526de045263a

  • SSDEEP

    12288:2cneg7Mx3GAOly3wObHGBuFlwmHUOSKcUcF5:kIe2AOswObmY0FpF

  Score

  10^/10

  snakekeyloggerzgratkeyloggerpersistenceratstealer

  • Detect ZGRat V1

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2