Extracted

• • Target

    c1bd96883587818b3cb169701f342d982a3a785164ef9261a70a49043f7f6817

  • Size

    1017KB

  • MD5

    02d49663964ca14885477e43bb4d8538

  • SHA1

    4bfef39721918c796c5ccdd19f0fba421c4fc937

  • SHA256

    c1bd96883587818b3cb169701f342d982a3a785164ef9261a70a49043f7f6817

  • SHA512

    6d89d0a58963b9f6ed520deac1c06008b23a575f461283eb3ed2896a6372bb381e41e4c0a51f657cdb64500eea1ec5d51ec787de22d092e79101efd96fb7da0b

  • SSDEEP

    12288:Y6wnpkQlkkaFIpiiXnXTVCRIaDQ2UtaQwXydUjSZv8PogcM+SwgT6AQSQy4A:Hgbg0nXoR429XTe4mNAtQy4A

  Score

  10^/10

  formbookzgratpp0tratspywarestealertrojan

  • Detect ZGRat V1

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2