Extracted

• • Target

    abaf1e6e0cadc624156319232e349005.exe

  • Size

    2.6MB

  • MD5

    abaf1e6e0cadc624156319232e349005

  • SHA1

    cd856459027e73b316e0998d0ed9823dcc3b272a

  • SHA256

    4bf50d078ab6f3cff117e42e77edf162d0ee9778993b585824157993c45c901d

  • SHA512

    c1cd273e818418effad7eb2f7116ea9cfcb8ac125cf66586bdabf2f9e542b90d1609c3e18f74898684f71d3d32dcd20de0aa91df4176d13f0427b112e2de824e

  • SSDEEP

    49152:KefMkcNeKO0lRR85uZ+C8X0muID5V8LJsnjP3QJop:xRQeKvlTgEm32JsjPgJop

  Score

  10^/10

  zgratpersistenceratamadeytrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect ZGRat V1

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2