Extracted

• • Target

    f9db076bd8f99c606cdae2d6eb5f4ec112a705cf285138331b33ae180c352fec.exe

  • Size

    31.5MB

  • MD5

    e79211ac8585538e841b54c4a72af824

  • SHA1

    e6136c5e0724f0c720e48b3eea0339b91f53ebfc

  • SHA256

    f9db076bd8f99c606cdae2d6eb5f4ec112a705cf285138331b33ae180c352fec

  • SHA512

    760e4a461a562f8a01796ed0c42fe87e9ecfa08ed6d012b056e0a187aac2a778f60351033e026107be07758b4ca8348e0853e9b4e4d59cdc1208b689557b2167

  • SSDEEP

    786432:SZ1AIF3dJszFfSDUPf+VKlRSadNdUTDaRXXaNu947NV3:U7ihKDUXiK3JndyGF/94f

  Score

  10^/10

  zgratratraccoon3c1e19ca7e90eb061bab2909496bea51stealer

  • Detect ZGRat V1

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon

  • Raccoon Stealer V2 payload

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2