Extracted

• • Target

    369be61aca46750085c842147909f80c8f938555071adeaceac6727bfcf74186.exe

  • Size

    2.3MB

  • MD5

    a717a432c558f56c46709d6d3ec9837f

  • SHA1

    ceda052be2519383085089a41c422ce2b1400a46

  • SHA256

    369be61aca46750085c842147909f80c8f938555071adeaceac6727bfcf74186

  • SHA512

    e859810a198b8b946581ed6197b1154856e736687dd593d383dc952a3afd597ed6b5a631a8e6b2228a425b809b772457e6e10e0ca6f68cd8f0a8cc637a81132c

  • SSDEEP

    49152:T+GJaXbo4IKA2WN4M63n4dHzCJYU6Mm4/4w2RAObR8XlZrzyiko:TboxWN4UHzCJYCmX5w1ZXyik

  Score

  10^/10

  asyncratzgratdefaultexecutionpersistencerat

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2