Extracted

• • Target

    2d1f544d92213574c8bc223be39f04b2

  • Size

    451KB

  • MD5

    2d1f544d92213574c8bc223be39f04b2

  • SHA1

    29ecf6bdf03e7016c97e19e2ee2ec784af4c7d2a

  • SHA256

    99a8f6273aac765671301a598da93d087ac05db96ba3d90b8840c6028232ef53

  • SHA512

    5cbec5530800e055d18f3e8695869b2f033d986206936afc36c79da38b005c5e87043a637bcbc26fca2b0440849d101cf4952ddab61529773a570fdc98ff0bb3

  • SSDEEP

    6144:aSao4K/dUeonLTYuT/4K8ZO5NmgO7Mndwz1jVb/EcN7zXvwBWCz0pehSTXUZ737k:Ko47Bjb4PZO47D1BbRnXvURhh37k

  Score

  10^/10

  snakekeyloggerzgratkeyloggerpersistenceratstealer

  • Detect ZGRat V1

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2