Extracted

Extracted

• • Target

    23941d12046f5a430d4ea87494091743

  • Size

    452KB

  • MD5

    23941d12046f5a430d4ea87494091743

  • SHA1

    476fcec06271d128340b5e0190647cd6484c6673

  • SHA256

    8d7c354cc8866c00da25ffb73d535596f4f77ca8ce7c0312bd39db103aa3403c

  • SHA512

    1f2bd49c21a953e53de0890c45feec71b0aa02c0d7caef875e0bc9ff30863199ffc39dac3f6721e84a7829483457ebc05ddfa7587ac701568b5f89194352bf86

  • SSDEEP

    12288:JBuaG/EM0/3YM0zEYQOE9EVSb0FEs2c/ATcqSqQIn:7uaGbqQ4b0550cSJ

  Score

  10^/10

  asyncratzgratdefaultratazorultinfostealerpersistencetrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult

  • Detect ZGRat V1

  • Modifies WinLogon for persistence

    persistence

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Async RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2