Extracted

• • Target
    d545f5b27e90abc54cf5a37c35e866c08336a500cecd95e8267c0c729a6b9bbc
  • Size 4.8MB
  • SHA256 d545f5b27e90abc54cf5a37c35e866c08336a500cecd95e8267c0c729a6b9bbc
  • MD5 90489ae7eda45c9ab0904ec54c1caa71
  • SHA1 ad96a6b3b10bb1452143f2fb0c450afb6ef6cd3e
  • SHA512 2f7f0494ae586bd0dc65cb9100d6259858de08970c980fff83a4169e04a192954ea88c38c0ec07d448c711a81ad710265a0ecc50e49d6709c35c1116c76816d8
  • SSDEEP 98304:qaKgooZW+SicdBQhBSpKw6XDb0j0VN6XXx86OA+jNIS+MYiZMqGk2s:qVglZW+SndB6PbQ06XCA+RISfZjGts
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  purelogstealerxwormzgratratstealertrojan

  • Detect Xworm Payload

  • Detect ZGRat V1

  • PureLog Stealer

    PureLog Stealer is an infostealer written in C#.

    stealerpurelogstealer

  • PureLog Stealer payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2