Extracted

• • Target
    ae2ff700d359fd591a9e90d86b9df2e5.exe
  • Size 668KB
  • SHA256 cc7cb2ebb12103aea621ec7962819aced4680b4322bc213a9257b36c8f2dab3e
  • MD5 ae2ff700d359fd591a9e90d86b9df2e5
  • SHA1 2a389b562b1df3ea1939029b6d11da4c6a53aa1b
  • SHA512 99c35bc5a0109daf2b53cebbffd1d06d51cabb61a38ba699584ddb142361e255b131cd778f44d9376dedda3214835cec0383d96d291596ee37544c9d1786eaa7
  • SSDEEP 12288:qsBU1IiueTZ/TTW918dp24ZojB4z8aPfvSsXVVKw//JXbakxGU3cl:FUyiuqZr28f2tYCsl1pXbajKe
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  asyncratzgratlords1ratspywarestealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Detect ZGRat V1

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2