Extracted

• • Target

    be5041fb817fe1edf7e6c487db9b5534.exe

  • Size

    16KB

  • MD5

    be5041fb817fe1edf7e6c487db9b5534

  • SHA1

    38040d570af54917957504bd88ab7c555e0ee3ba

  • SHA256

    9663cb27096c5592837253411ddee56a54b84b1851cd77e7b33768091ef26fa2

  • SHA512

    8a0200768436ec3e06b11b2447136720af887398d37bc3e635dd417b5dfd86734f8ebc425ed1e8eb2b2689838f3acda0f9a3f6192a54460b4da1027112d28e62

  • SSDEEP

    384:XZ5sjmrXdBJsVbWcoWj7/D1IDBRJJSrxGw6lx87Pr:p5sjmtsV7PI1PmkEr

  Score

  10^/10

  purecrypterzgratdownloaderloaderrat

  • Detect ZGRat V1

  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

    loaderdownloaderpurecrypter

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2