Extracted

• • Target
    87a53e43fc1a838c52130abe4607eb0ea70802f3b233e4e74c9edca5920ed2c5
  • Size 3.8MB
  • SHA256 87a53e43fc1a838c52130abe4607eb0ea70802f3b233e4e74c9edca5920ed2c5
  • MD5 5297fc3e53d37d8d673c038dc55efebd
  • SHA1 f78c4cc2fa80af00cd84128a8a4bcd54b6768206
  • SHA512 10ade61bbbafadb2cbe9726aaf445e3e3d02cfd36ae86b294c083ac5dd0a5e6fe8fbc421814f5438fd16601c19626f195df4a72eb9f98a06b9a7e1e6d3c19657
  • SSDEEP 98304:jJoqfS4A/EKZcD0X3lkRtWopFrdTQAI42+:NRFpD0X32GkdTQD4
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlinezgratsp-19agilenetdiscoveryinfostealerrat

  • Detect ZGRat V2

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Zgrat family

    zgrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Suspicious use of SetThreadContext

  behavioral1behavioral2