General
- Target envysx__FB-e7faafa4-c042-45ec-bba9-c06e68f41425.zip
- Size 9.7MB
- Sample260412-fxfcpsg18y
- SHA256 d524dbba554a51441a6770f44c35972c52e4aee69c5b431660bee3993a3e28e2
Score
10/10
Malware Config
Targets
-
- Target envysx__FB.exe
- Size 19.8MB
- SHA256 d6b87cfa3b8c118fce9c3bd40ccc995b38187e8e570492aa43070fda3af492d7
Score10/10-
Detect ZGRat V2
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Zgrat family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Suspicious use of NtSetInformationThreadHideFromDebugger