Extracted

Extracted

• • Target
    caf7afab30b06cd0f7e04e58d74eae92
  • Size 248KB
  • SHA256 ebbddbc283ca755442e0651f50ca542a01b896fb05fa62ad18270f791ecec6bb
  • MD5 caf7afab30b06cd0f7e04e58d74eae92
  • SHA1 d2f660783a60f769a145e6950382ec14aa058604
  • SHA512 deecd35d3f36130e4e6faec6b8f8964399f1e9f4ede11096bf6d0e7ce8036dbe375f8be93cd5a864c1d7e03de2535ec2885413a497a4f0b7775a53035fdaee8b
  • SSDEEP 3072:Hveff3/WI3G4qvOLOdbR7JCCNxNlZjemWa6hg5GuGUgMdZafD4UA1b:HEJG9mGR8CN3ymWa65uRb4cxb
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  asyncratgcleaneronlyloggerxwormzgratloaderpersistencerattrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Detect Xworm Payload

  • Detect ZGRat V1

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Async RAT payload

    rat

  • OnlyLogger payload

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1