Extracted

• • Target

    tmp

  • Size

    157KB

  • MD5

    5790d1417f8f00bd7ec6fb7011c79d9c

  • SHA1

    36076ed9457c45d94e664ea291eb01e5c70d084b

  • SHA256

    ad07503bc046f5b3d65eb61646fa826bc39560916c6e1ef2c3437b6465b30a82

  • SHA512

    b19195510624ad16a4730282c97b68d05e4890a33d91f86f24eaf921e23e7786649e4e31aaaec2d9d6c7bb3695c615851d7aed3e53b13083e03acbc8d0543ef0

  • SSDEEP

    3072:XahKyd2n31D5GWp1icKAArDZz4N9GhbkrNEk1eT:XahOfp0yN90QEB

  Score

  10^/10

  meduzazgratcollectionpersistenceratstealer

  • Detect ZGRat V1

  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

    stealermeduza

  • Meduza Stealer payload

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Executes dropped EXE

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1