Extracted

Extracted

Extracted

Extracted

• • Target

    New Text Document.txt

  • Size

    211B

  • MD5

    ab792943e8199361fd3e9fbc083c4cae

  • SHA1

    2359401e23adce22075295db3535d84041aafeea

  • SHA256

    8c4ccacd4287b5666ef559ef8ecc3cdb6bf51abfaf1b66532eaabb340eed9dca

  • SHA512

    58fba50dcc76903d0aac4cf0f119dfc0d0eddf1cd2a3cb80c99bd378ef254b5c3ebe61bd0d542360bb7836e39db4454796511d113b35485b5e47b14e95e46918

  Score

  10^/10

  asyncratzgratexpolergoogle chromemetamaskwindows defenderdiscoverypersistencerat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Downloads MZ/PE file

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Registers COM server for autorun

    persistence

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Blocklisted process makes network request

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1