Extracted

• • Target

    2306f30c88ec80cc78a0612769244734

  • Size

    580KB

  • MD5

    2306f30c88ec80cc78a0612769244734

  • SHA1

    411ed421db289e58f7374ddcb6a98d1dc088e346

  • SHA256

    792d5d8408b4fc83ba11e298c876d53ffa027dbc46502f2e837aa7f47f30e0fd

  • SHA512

    107c2638fec2bb5b4429aaf9c54d5a251eaff9f0313b00cdc7d82e5e2f825ea886b88c96d15ebbd09307c514e2f09c46b07d23a604d5db8b8ab50e8a8bd7f363

  • SSDEEP

    12288:6wwLsTopwqlneDk+Fz3FjwVIRKGrCt3UfshJyIeIgXIPIPnuacF:UAx7CPt

  Score

  10^/10

  snakekeyloggerzgratkeyloggerratstealer

  • Detect ZGRat V1

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2