Extracted

• • Target
    537c699746f473de4328110745bc9314a402bcb778788479b48bd14e72da8028
  • Size 433KB
  • SHA256 537c699746f473de4328110745bc9314a402bcb778788479b48bd14e72da8028
  • MD5 424d28ee2fd32de5b5e518e1e165bd5d
  • SHA1 4b469b997a7b63d43821ef472a97de37374316f8
  • SHA512 c9db5c97701138bcc48daeca0328aa2000e00a3351da6871e5486cb988dc88cdc7af45297b1c1577cd17eeced8b0c4ad4acf2e45e1c6ca3b6ee13cf396067e68
  • SSDEEP 6144:l3q74GdQHToQy0nMBOAbET1QnQnW904sDy1g450C0Ah8D6ptHfACCYLr:3GZvbETPWpkl45mpA/MY
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlinezgratlogsdiller cloud (tg: @logsdillabot)discoveryinfostealerratspywarestealer

  • Detect ZGRat V1

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2