Extracted

• • Target

    tmp

  • Size

    2.7MB

  • MD5

    d1cc7d267d5f9a288aebe21433875a09

  • SHA1

    9cdfbf1a009a65e5c1e1aa0e4cf1e06302cae735

  • SHA256

    a5c0d4c059432a9c8a129c8f6bd0d27f587cbafb568e866cc8f360d9bd315865

  • SHA512

    5027d404d97f7f154ac15bfe73df06f0bd9bb6ff8aec3c1ac2292c07e621cfd646f27ddd28aaf94149f517e5f10256e1041ec6ba961544572255d86d67de78f0

  • SSDEEP

    49152:cBS+smeLEt8D7vFHA8vEGvm4g+CSkeQ6sUrvWTCrTkVNi0H:cymFM8GvXzhQpVDNi4

  Score

  10^/10

  revengeratxwormzgratpersistenceratstealertrojan

  • Detect Xworm Payload

  • Detect ZGRat V1

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • RevengeRat Executable

    stealer

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2