Extracted

• • Target

    4ecffa97a74eb985f88403ca71d8903d.exe

  • Size

    405KB

  • MD5

    4ecffa97a74eb985f88403ca71d8903d

  • SHA1

    a9fe0554de2a06ff95d2083e09fbad0e2ddf1854

  • SHA256

    c6f76992c34b7439ff565cd3f928a642557b7ae4bb44bbd76e228b20a9b4b6d4

  • SHA512

    baeb16e0dd164167c9e4f4f1b907e9fd1ae225c3540aa913f89d9f3d3510a21fab16ac73cb3fe1f563df514e85c09bd191b472c8ee22960b97b2e6a6370ef05f

  • SSDEEP

    12288:oJYmhDsoASTnOMuMvjesMo3oKAFblLE2+c57dVh:dmJKdGKlKuB0c5BP

  Score

  10^/10

  xloaderzgratehp9loaderrat

  • Detect ZGRat V1

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Xloader payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2