Extracted

Extracted

• • Target

    Vespy/VespyGrabberBuilder.exe

  • Size

    12.6MB

  • MD5

    fab385fb154644665f94aca9424fb0ce

  • SHA1

    8dc525108cebd97b3127129cc1633a7f31010424

  • SHA256

    c08b63c50a78ca119a5ff4fe10592a0f66289708df38349e91e645214aae7576

  • SHA512

    07def38b8590ebaa95d7213e77e3892f60f10a87cef797fa07c6feb033f08d4148024360c7c32b5f92441c41236b8a86e66cee59bb51d6fbde97b86923a640e3

  • SSDEEP

    393216:NayDfg/3Y8G6jgVINcfwt+F2CZZiLe2Wq:wyDfYPwPwtO2Mie2J

  Score

  10^/10

  growtopiaxenoratzgratevasionexecutionpersistencepyinstallerratstealertrojan

  • Detect ZGRat V1

  • Growtopia

    Growtopa is an opensource modular stealer written in C#.

    stealergrowtopia

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Creates new service(s)

    persistenceexecution

  • Stops running service(s)

    evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1