Extracted

• • Target

    b20de9452f77b912c49bd307cc1e2550abb4e17d8497655e64ed0883ce4cfcbe.exe

  • Size

    6.6MB

  • MD5

    7cf0ba422c37585d399e4dffb0b7757c

  • SHA1

    d7b1b39ccdb9287edbae0aa9496ab1d678a4780b

  • SHA256

    b20de9452f77b912c49bd307cc1e2550abb4e17d8497655e64ed0883ce4cfcbe

  • SHA512

    f28f438298954bdabfeb8848dcafe35e074b1750c32e9f01268e41ced8a2acac3e298159b85f159e9c9d4814f73ce2b89c1d8a8afc4a7a2ab30c2258dc3237c1

  • SSDEEP

    196608:2UU5u4Ef30GhXdLPLPCiZMwVnvrgDK+Sshs:Z6FEvHdHC2M8vlEs

  Score

  10^/10

  meduzazgratcollectionratstealer

  • Detect ZGRat V1

  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

    stealermeduza

  • Meduza Stealer payload

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Deletes itself

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2