Extracted

• • Target

    WhatsApp-cleaned.bin

  • Size

    3.9MB

  • MD5

    eb98e1dcc374d67e71a85ecc848034ec

  • SHA1

    002409d45df360fb9902fb60bb316a863c735aa2

  • SHA256

    078bbd30cad5587f8dcde105e04046cc56f8d3cef527993faec4341920e6a8eb

  • SHA512

    1f168da8f33084c04d7963528bd29fcd81cb6b7e63534096053b1726ebd33b417f4089c16884e1e9d6e4a055c298ccea1f0d22f7970ff951d63efcd4e7f8b76d

  • SSDEEP

    98304:oCDnyTWzDCidsFXGAtljN36bZfRE7Rtc/vNK3egPJ:o2qM+idivVNKbZfREVtc0PJ

  Score

  10^/10

  redlinezgratws-19agilenetdiscoveryinfostealerrat

  • Detect ZGRat V2

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Zgrat family

    zgrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Suspicious use of SetThreadContext

  behavioral1behavioral2