Extracted

• • Target

    !!@NeW_$etUp_2024_pAsSW0rds$_.exe

  • Size

    13.7MB

  • MD5

    b1cb85d0689f64c6373345fc6b084f5f

  • SHA1

    9901c71cf849f77161732f1ab9631b111fd00753

  • SHA256

    94ab177cc62af8c0fa1d2a0be6575db5bde69a52d126293e6a7fe5c01607597d

  • SHA512

    3a2751b43a725fa436907156f3976a93eaebbcaa93eb3118f35ceb7268cd9f3a5037f8b02216dde58fdf6e766a728fbf8db5668f67dd3225342e1411e83f2f51

  • SSDEEP

    393216:uPUByGBdf6xy5DEs5Rr7+EVrwRGJvxPjVHs+i2sUC8RS:uPkyGBdIy5DIEqY3M3T

  Score

  10^/10

  lummazgratratspywarestealer

  • Detect ZGRat V1

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2