Extracted

• • Target

    64056033e63fcbdf3ad08733fdc82e2a

  • Size

    541KB

  • MD5

    64056033e63fcbdf3ad08733fdc82e2a

  • SHA1

    e44805dd87b5e2525765d8f6af4a32bd57481cb7

  • SHA256

    de329c7b6d4e98b53a3a24d4d01e5f3c9534eefe786368c95e350a67505a7ebd

  • SHA512

    a0fb3c006eea87938e97e49a9b48a1a3ac3de932ee6f06584e01223dbba4847bf5b904b04225225a454c0c7815a8b767945cec7cc8c1b7ccc750e408908ccb19

  • SSDEEP

    12288:mZhRK2sHSIPU95HRyslUVrEUNNyhDHmMDWmh14lDgL6m+1Vr1kd95f1t:mL4TiHVxLJfj

  Score

  10^/10

  snakekeyloggerzgratkeyloggerratstealer

  • Detect ZGRat V1

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2