Extracted

• • Target

    AudinoBuilder.exe

  • Size

    5.6MB

  • MD5

    c4cb065184458a9e05b7c893642f9b3c

  • SHA1

    36327e2e82c26c3d39dcc51569c08c624c90ae20

  • SHA256

    1316e22fe1e9b3d4a9c42362c21bca74598cdc11eae27282a29871fb98ab0b38

  • SHA512

    2e9809bce89db2566c7aa9143afc5c818cc2765ea6c0ab2e8d583aac7a7b1cca5d601b5ecb8cc676221118ab2b8b333eea7fad614f5150ae95c76b979388faa4

  • SSDEEP

    98304:lKAVWycWWgSj67/ngnLqAABRvCrnVAo3tH/Gfz7H7YzA4AzRP2HjdgW0NaBFV:8TylWgSj6DnDvRKrnVAoBQHHkERPPW0K

  Score

  10^/10

  xenoratzgratevasionexecutionpersistencerattrojan

  • Detect ZGRat V1

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Creates new service(s)

    persistenceexecution

  • Stops running service(s)

    evasionexecution

  • Executes dropped EXE

  • Drops file in System32 directory

  behavioral1