Extracted

• • Target

    87a53e43fc1a838c52130abe4607eb0ea70802f3b233e4e74c9edca5920ed2c5

  • Size

    3.8MB

  • MD5

    5297fc3e53d37d8d673c038dc55efebd

  • SHA1

    f78c4cc2fa80af00cd84128a8a4bcd54b6768206

  • SHA256

    87a53e43fc1a838c52130abe4607eb0ea70802f3b233e4e74c9edca5920ed2c5

  • SHA512

    10ade61bbbafadb2cbe9726aaf445e3e3d02cfd36ae86b294c083ac5dd0a5e6fe8fbc421814f5438fd16601c19626f195df4a72eb9f98a06b9a7e1e6d3c19657

  • SSDEEP

    98304:jJoqfS4A/EKZcD0X3lkRtWopFrdTQAI42+:NRFpD0X32GkdTQD4

  Score

  10^/10

  redlinezgratsp-19agilenetdiscoveryinfostealerrat

  • Detect ZGRat V2

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Zgrat family

    zgrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Suspicious use of SetThreadContext

  behavioral1behavioral2