Extracted

• • Target

    d0f7fb07005ab151b76ab0cd9f5b45a7d319fb3273044c2f5b66a491c6161f9e.exe

  • Size

    2.3MB

  • MD5

    90c738cebe2f8dda5d53e777ad286a43

  • SHA1

    58daf4a99c9c148f38b3e6173d5f7ac01bcfaf16

  • SHA256

    d0f7fb07005ab151b76ab0cd9f5b45a7d319fb3273044c2f5b66a491c6161f9e

  • SHA512

    7b77c041a5e1548403db8f749c90209a5bb4a8c1c178003d7af2641f94e1745b6e89abadfed441dd41c492cd134863afb57353a918d94ce308b2884cfdf29620

  • SSDEEP

    49152:Trp/mzum6MFkh5lLEwloDrFHJ/PXbU2HSu8KiDDjCBrVaQWMZ00r:8zum6My14wmDrFH9XcuuDDGBxaU2a

  Score

  10^/10

  amadeyzgratpersistencerattrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect ZGRat V1

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2