zgRAT PE Executable malware analysis – 87bc17f56e74

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

File

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

Low

1 malicious · 111 files

EXE87bc17f56e744e74408e6ae8bb28b724zgRAT

Structure

P7B[Authenticode]_a6e0d8a0.p7b

BINResources

BIN.Net Resources

Name	Value
Info	Authenticode present at 0x37D600 size 9144 bytes
Info	PDB Path: Fiddler.pdb
Module Name	Fiddler.exe
Full Name	Fiddler.exe
EntryPoint	System.Void Fiddler.frmViewer::Main(System.String[])
Scope Name	Fiddler.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Fiddler
Assembly Version	5.0.20245.10105
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6.2
Total Strings	56
Main Method	System.Void Fiddler.frmViewer::Main(System.String[])
Main IL Instruction Count	28
Main IL	ldc.i4 2 stloc V_0 br IL_000E: ldloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] br IL_0082: ret call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void Fiddler.frmViewer::SetConfiguration(System.Object,System.Object) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) ldc.i4 1 ldsfld <Module>{0a1100fc-235a-4606-8878-28ebfa2d2e62} <Module>{0a1100fc-235a-4606-8878-28ebfa2d2e62}::m_291318e627eb4e5fb4b2ccb180b1a7b7 ldfld System.Int32 <Module>{0a1100fc-235a-4606-8878-28ebfa2d2e62}::m_ca4032db490943f786d4826d5620fc87 brfalse IL_0012: switch(IL_0082,IL_005D,IL_0028) pop <null> ldc.i4 0 br IL_0012: switch(IL_0082,IL_005D,IL_0028) ldarg.0 <null> call System.Void Fiddler.frmViewer::RegisterConfiguration(System.Object) ldc.i4 0 ldsfld <Module>{0a1100fc-235a-4606-8878-28ebfa2d2e62} <Module>{0a1100fc-235a-4606-8878-28ebfa2d2e62}::m_291318e627eb4e5fb4b2ccb180b1a7b7 ldfld System.Int32 <Module>{0a1100fc-235a-4606-8878-28ebfa2d2e62}::m_855e4420b8a145fe82fec11a0ee960ce brtrue IL_0012: switch(IL_0082,IL_005D,IL_0028) pop <null> ldc.i4 0 br IL_0012: switch(IL_0082,IL_005D,IL_0028) ret <null>
Module Name	Fiddler.exe
Full Name	Fiddler.exe
EntryPoint	System.Void Fiddler.frmViewer::Main(System.String[])
Scope Name	Fiddler.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Fiddler
Assembly Version	5.0.20245.10105
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6.2
Total Strings	56
Main Method	System.Void Fiddler.frmViewer::Main(System.String[])
Main IL Instruction Count	28
Main IL	ldc.i4 2 stloc V_0 br IL_000E: ldloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] br IL_0082: ret call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void Fiddler.frmViewer::SetConfiguration(System.Object,System.Object) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) ldc.i4 1 ldsfld <Module>{0a1100fc-235a-4606-8878-28ebfa2d2e62} <Module>{0a1100fc-235a-4606-8878-28ebfa2d2e62}::m_291318e627eb4e5fb4b2ccb180b1a7b7 ldfld System.Int32 <Module>{0a1100fc-235a-4606-8878-28ebfa2d2e62}::m_ca4032db490943f786d4826d5620fc87 brfalse IL_0012: switch(IL_0082,IL_005D,IL_0028) pop <null> ldc.i4 0 br IL_0012: switch(IL_0082,IL_005D,IL_0028) ldarg.0 <null> call System.Void Fiddler.frmViewer::RegisterConfiguration(System.Object) ldc.i4 0 ldsfld <Module>{0a1100fc-235a-4606-8878-28ebfa2d2e62} <Module>{0a1100fc-235a-4606-8878-28ebfa2d2e62}::m_291318e627eb4e5fb4b2ccb180b1a7b7 ldfld System.Int32 <Module>{0a1100fc-235a-4606-8878-28ebfa2d2e62}::m_855e4420b8a145fe82fec11a0ee960ce brtrue IL_0012: switch(IL_0082,IL_005D,IL_0028) pop <null> ldc.i4 0 br IL_0012: switch(IL_0082,IL_005D,IL_0028) ret <null>