Extracted

Extracted

Extracted

Extracted

• • Target

    0x0006000000023286-3800.dat

  • Size

    38KB

  • MD5

    f874f242a30d6873edb7eaf2db40cbdb

  • SHA1

    5a162d4052d569aebcff2432f62c43ffb2867fee

  • SHA256

    ffee6552e3258166c9ef418c12f67d1167cf7dc9abb29b8d4e49056607ff2c0f

  • SHA512

    a52e1f03ca548f3118f3a8b8c7bd2493f16358b6e6c6b7619f5cb05596f7c02fe178b150c7f558dce1a7f19327cf21b3cc85932ccdeab2ac5dda1f7192b608b0

  • SSDEEP

    768:d8n3N4JRqwg8UTB+8zx70f0PSuopLwlFFWO7:dmN4JRrg8ypxSKFFX

  Score

  10^/10

  gluptebaredlinesmokeloaderzgrat@oleh_psup3backdoordiscoverydropperevasioninfostealerloaderratspywarestealertrojan

  • Detect ZGRat V1

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba

  • Glupteba payload

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    evasion

  • Deletes itself

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2