Extracted

• • Target

    3b64d762e842be0cf603e965dc9ac055

  • Size

    566KB

  • MD5

    3b64d762e842be0cf603e965dc9ac055

  • SHA1

    918f7d5f6bbf067e7ecc308dd22b05bb5f9ac990

  • SHA256

    f816be2bf5976cc678ae6a01bd493d0d95287b55399652ce0bfe5f1e7b5a577a

  • SHA512

    4e877ec1260f072766d243fe5b4cac75fe0ccc1abc685da75ef763c2ff6c80a9bec63ea85e34c65362d0d13b76304c8d6ec86062e0dedff50e69fd4f71925607

  • SSDEEP

    12288:3Fy0AGAaTzP3SYkfJzJuSIW+mN9EmHipN9h50B8UhvikaEOe:3Fy0fPKUEX

  Score

  10^/10

  snakekeyloggerzgratkeyloggerratstealer

  • Detect ZGRat V1

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2