Extracted

• • Target

    cd3b868bc32923f0594cd595c9914be5

  • Size

    338KB

  • MD5

    cd3b868bc32923f0594cd595c9914be5

  • SHA1

    78999abb16a82feae55918e7b1a4c1fd4333bae2

  • SHA256

    fbfc3b16c84c52caf89196f4340d5725cfd1b95b31603b4b9c9119ed73a0d2dd

  • SHA512

    64eebab73d0ec4fbca54829bc1d24adce9df79480919e78ad649bc7909cd7a8ed584e5bedf00c13d58c3c7564e4c7092208745792772762d94e88ba6404ee5d2

  • SSDEEP

    6144:IeZn/oGcW4pp30+JVdYDoQRGaB4giSR7U3EwWx9bOHkrka:IeFQGcWUkWSPBDiWtyEIa

  Score

  10^/10

  redlinesectopratzgrat@chmoeblan1infostealerrattrojan

  • Detect ZGRat V1

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2