Extracted

• • Target
    Geometry Dash Repack by KrutoiDedusZhar.exe
  • Size 16.2MB
  • SHA256 999bc8a61afb4843972ebf37989c2c77f31bd68442f12d159d95667ef3565b5e
  • MD5 24399d27acdd681214d34b3a75b148aa
  • SHA1 054484fdec547003ceb5d027e9016c58a60caf3d
  • SHA512 0be8f36fd5ac0bbe5c530736ac3c403f3bab0df52d4f2d810166cf11caca7cebe4f4f646a60a236ce6db9d9fdbaecbf19a007e0c0d7aca7351af0460a68d0860
  • SSDEEP 393216:g8mXXCNdFV0JqKFY6E5oRp4fakIOH4DByqjO2r/4o:gBngFq0FWosScyQV9
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  asyncratzgratdefaultpyinstallerratspywarestealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Async RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2behavioral3