Extracted

• • Target

    53194577cd4fba0771195757ce9ed5de

  • Size

    574KB

  • MD5

    53194577cd4fba0771195757ce9ed5de

  • SHA1

    405ce718b554eedb1a290451f168c11f67b567b7

  • SHA256

    582d2b367536b458a42576e4587e577e8f8623c8030464cd7fac775ccdb0b647

  • SHA512

    ada678b0d72c84e2c7774d5dff1703ff7a8d9616301dfe543e73b685a9d6522309a5524e9c6d00b40e972f61fdb43409df0cbdafeb2ed28c536304265051921b

  • SSDEEP

    12288:J/IG9qK4cyWs0jftcWCXTpaSgwwtj5GOUcloK:99kc/sgft1EpDsAVclo

  Score

  10^/10

  zgratpersistencerat

  • Detect ZGRat V1

  • Modifies WinLogon for persistence

    persistence

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2