Extracted

• • Target

    d1e97dd47e3903ba07de598a3048d1bffff8df29c47cbd852c958a4c210d677a.exe

  • Size

    68KB

  • MD5

    ac015ea331170ea31df4abc5461b51f4

  • SHA1

    f31473ebcab052a6a632ce165fd7c717b8add5d4

  • SHA256

    d1e97dd47e3903ba07de598a3048d1bffff8df29c47cbd852c958a4c210d677a

  • SHA512

    e33d433df818f096d09b3f5337800a98fb2d88fd07d75a722edfe8b8d7cc57c599c3431fbf5809c718c802e60fd00fa2a2a46a1c41fe8b6a7e586a7b2c5aa615

  • SSDEEP

    1536:y1gopCTSbwFnN/GGGw8RbXnnzo5d9Zb35LhlEDSUlJA7FAx:yISkFAq8Rbnnzo5d9Zb35LhlEDSUlJA

  Score

  10^/10

  purelogstealerstealerxwormzgratpersistencerattrojan

  • Detect Xworm Payload

  • Detect ZGRat V1

  • PureLog Stealer

    PureLog Stealer is an infostealer written in C#.

    stealerpurelogstealer

  • PureLog Stealer payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2