Extracted

• • Target

    dotNET_Reactor.exe

  • Size

    15.9MB

  • MD5

    b8b690a0a2b61714b7f4a928a513182f

  • SHA1

    63e466c49496a8be6a0f86644b031fd1db880c82

  • SHA256

    212aca6c26f53a9a28f22019f2ce4143daa98db2fdb0c9515f7e6e2fb6822e0e

  • SHA512

    3c1605c6ae9020d2ec13deb891c86eb0d43d0e106c41e969e890b875f706c7f607c03a5ae4236d89fe40c367ad8eb0e4cb78aeb1b9ea6764937708bf4b250463

  • SSDEEP

    393216:4EjFakaECvYN6k0dgW7YMCDNlM7TMLl+BB1f9qTs7:4KWECQt02W7YXKXZBVETs

  Score

  10^/10

  xwormzgratrattrojanvmprotect

  • Detect Xworm Payload

  • Detect ZGRat V1

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1