Extracted

• • Target

    23722503bdcc20ab9e6482bb2d3e92e50b13443799f361975bb36a91f0eeb895.exe

  • Size

    717KB

  • MD5

    ec88a4c1dcfb3861f6c9c364deeabd94

  • SHA1

    ed0d81e041345ddc9ff9fea8bad197ee1a66fe82

  • SHA256

    23722503bdcc20ab9e6482bb2d3e92e50b13443799f361975bb36a91f0eeb895

  • SHA512

    81f6ed64f54778aa59afbc515dd6a40b5acac397348801dadbddcfdc15711144c3085e08099ba2a28a98055039916ade0e0cde1ea6fcf78b1f5962e8651609a7

  • SSDEEP

    12288:rtHCL6YFXDk8fwYXzlRLf3AM+lsEttF2s9NgztG2Qk/sxJhT:xHq6Y5hRLsGEvF2sOtGkIh

  Score

  10^/10

  zgratratazorultdiscoveryinfostealertrojan

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2