Extracted

• • Target

    51e431b4fa084108a9524d0467a925d518659ac886be3451ffe5ec86da707f4a

  • Size

    2KB

  • MD5

    17dc01efda95cad71f3de00a136a6672

  • SHA1

    7277a278d3c453adc868f5b27c2e937db3b0bf80

  • SHA256

    51e431b4fa084108a9524d0467a925d518659ac886be3451ffe5ec86da707f4a

  • SHA512

    33daa7f80b2e230ffd83e9211aa818679be9c0450871002ae0dc1892601592140011897173094a9e68bc9b164562f712633b9c56f5e273d636889d6923779f48

  Score

  10^/10

  rhadamanthyszgratexecutionratstealer

  • Detect ZGRat V1

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2