Extracted

• • Target

    51a34678b8a4c241c41ce4f326e9fb6f01607b1bb4a302b64a6e4811d789eb02

  • Size

    1017KB

  • MD5

    4222ed5bb25451fef7d58549badafdda

  • SHA1

    9c22cf9967db38863975964315757b61c8f4b883

  • SHA256

    51a34678b8a4c241c41ce4f326e9fb6f01607b1bb4a302b64a6e4811d789eb02

  • SHA512

    2c350316c8062e0a23716e904cf237a5e42ff1ae2e083addda37b7f34dc404e47d8b039b9f4a0f8cdb2dd95c31f28f9b4979337a69cb5c88cd0235d5e29a981c

  • SSDEEP

    12288:Y6wnpkQlkkaFIpiiXnXTVCRIaDQ2UtaQwXydUjSZv8PogcM+SwgT6AQSQy4A:Hgbg0nXoR429XTe4mNAtQy4A

  Score

  10^/10

  formbookzgratpp0tratspywarestealertrojan

  • Detect ZGRat V1

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2