Extracted

• • Target
    Cold Turkey Blocker Pro 3.10/CTBActivator/Activator.exe
  • Size 7.8MB
  • SHA256 b9ef692ccc85d8d010ab568f80622ded90813885f459cfe5b47175f5c854a236
  • MD5 49e0ff5b272c2e4edc2b45a71d1dc3a0
  • SHA1 89faa62ed4fdca507024e3b4368cf294545aee49
  • SHA512 d29c2dc8fde21ab8f480342b1542f0199d0cb94d9bc31a7e7450e4874f046f62b1dd6bf0913b87429af1ac6e476c2b55fb79af62af144e779b57f51442a30901
  • SSDEEP 98304:u3q35gz3xycD3d6wkq6PnYsnmGug3KEA4pdyEsQ:Fgz3xP6wkjPnmG9jb
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  rhadamanthyszgratdiscoveryevasionratspywarestealer

  • Detect ZGRat V1

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    Cold Turkey Blocker Pro 3.10/Cold_Turkey_Installer.exe
  • Size 55.9MB
  • SHA256 91fbb470a8fd8dfb3df4f8deb007cacd4942eb2fc7472ec182ef17a3e66ebbff
  • MD5 78b909d37b3033ad4a6e9a58ab5fcea2
  • SHA1 b58335f022de47b3a6ecb9d627056b5eb648a4c5
  • SHA512 ac2eb803b9236e2c30984ca1a51d7e5338bf6a6fb3cf0b8d3849471ec1433d656a45258fe42ade1c9e303a1ce8bc5528d070f9bff9489cce130ed257be4d921b
  • SSDEEP 1572864:YwG0VcRVVc6z7gzw/b8/olZgyA0df8h09BCvW:JoG6/b8uZgIdf8RW
  • MD5 SHA1 SHA512 SSDEEP

  Score

  7^/10

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral3behavioral4