Extracted

• • Target

    3af0ce733eb180c167d348a987847ab374487def7fff4136326818e53a61db42

  • Size

    378KB

  • MD5

    e59ad382ebe9af3c0c747009e860a171

  • SHA1

    64173991a52a1916c7760a02c687d4685653b670

  • SHA256

    3af0ce733eb180c167d348a987847ab374487def7fff4136326818e53a61db42

  • SHA512

    5431adb8ea1c75d6569ca8743614c9c45e8bb1f00e0218f868c859bdf5230c09d0a8686394d925158ba992f942a1e07c32ff08fd77aa4f7cdb348c6ff6cbee42

  • SSDEEP

    6144:AwSQES4tWjmeWeWhDwpP1b9GdhDmeqtEuvKJpBLX1tbLUpok7F:RdES40jmeWypP1xGdhZiEnpBLX1tGVF

  Score

  10^/10

  stealczgratdiscoveryratspywarestealer

  • Detect ZGRat V1

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2