Extracted

• • Target

    795921061997e8c1fe2c61df65a8ba2a

  • Size

    5.6MB

  • MD5

    795921061997e8c1fe2c61df65a8ba2a

  • SHA1

    8df4896d0686ba1fb6cb5ad04517019be7a46dde

  • SHA256

    b12ca6670877a54a4762123516c35021e8ec9c5c231f31a134cde611fea65490

  • SHA512

    7d6eb9087ed6eedbda164aada9a3c792e2e03b754cee59402287da26ae58e3c3a6b45bd31dc90a593a627709ba8eae479de91d6929ca7b1a20edc98b2ff780c8

  • SSDEEP

    49152:xLggQyNoVWo1AAP+TxjQV4tuTbBesknFLIxYB0lj81zcZs:6yN8gTxsaQ9wFLIuBI81Us

  Score

  10^/10

  zgratratchaosremcosremotehostpersistenceransomwarespywarestealer

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos

  • Chaos Ransomware

  • Detect ZGRat V1

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

  • Detects command variations typically used by ransomware

  • Renames multiple (196) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2