Extracted

• • Target

    3644efb050a5e1733ca9dc4f6a32fba33883497c41121cf5a7de4837236690e0.exe

  • Size

    48.5MB

  • MD5

    645793d9e9330d225a3b3dfd20e20064

  • SHA1

    4344014c90b9a3ec79750998cdc5b68df983cd59

  • SHA256

    3644efb050a5e1733ca9dc4f6a32fba33883497c41121cf5a7de4837236690e0

  • SHA512

    c8957f5fdf202f73e68d5e2397799f6f420b123df91743330e4d2495675c67e4d74a10e0030fb1c4d314dd1173a3b3c905db752f5d87600e8a8dcc18efb5297b

  • SSDEEP

    1572864:Pwc6WzPrjxZFn1D0mNt1XhIEuX6LwkLXZwy:Z7BZd3f8uw

  Score

  10^/10

  asyncratzgratdefaultexecutionpersistencerat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2