Extracted

• • Target

    33fe683a4f96d2b64616814f7473f9ad

  • Size

    486KB

  • MD5

    33fe683a4f96d2b64616814f7473f9ad

  • SHA1

    1dfecff86628341cb0f5208c6957a970e2729a99

  • SHA256

    4b6d2d4d20ed03f56ffffc9c92549c99b7bd4494c7335790e9cae0e0b5824193

  • SHA512

    3e8ae602b91151780f6b0c58f3409f19d7680ffd6bd979ee9c380966cf9442de06f031af4162da82204f87317c68bd59dc14a737e5e189b58171f343fd0963aa

  • SSDEEP

    12288:tqXS3Nv68mo+UmaKOmGa1NoigDRlBda3w:wQtFYUUJUDX/a

  Score

  10^/10

  snakekeyloggerzgratkeyloggerratstealer

  • Detect ZGRat V1

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2