Extracted

• • Target

    8370e6258d17dbbf8e9f4f3dced934ab

  • Size

    465KB

  • MD5

    8370e6258d17dbbf8e9f4f3dced934ab

  • SHA1

    0a276283e3784d2d5443deee623fc1ed29ae21d4

  • SHA256

    8a62013424695bf95dea19f504de1636f2093be8b27c3f314b2daf617b00ec1d

  • SHA512

    46b70138cc34405df1a4f716064e137ba7b1f69f178de9a1988e63734fe21d066c4f3a4818676ca7e8df720086446db94b59c5fd0bacfb07cc8c72b635f2b014

  • SSDEEP

    6144:GhzpyQ/Hr2KeDYdk495R+2rbjUR0oXFL9P2XYtJkWDGDS9Jo4IZNW8u2wND8:GdF/HRly4rnrbCLMXYXDGAJoT2T/I

  Score

  10^/10

  revengeratzgratnyancatrevengepersistencerattrojan

  • Detect ZGRat V1

  • Modifies WinLogon for persistence

    persistence

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2