Extracted

• • Target
    b851e0dbee4a0e26a38ec6e54c0ae716c9c1a6be78a84c053cbc1eda5030ef11
  • Size 430KB
  • SHA256 b851e0dbee4a0e26a38ec6e54c0ae716c9c1a6be78a84c053cbc1eda5030ef11
  • MD5 9a964e2155d7fe6230c9cf5782f2ae76
  • SHA1 601f037bda64b91fc725a9fe2435d4fae59432f6
  • SHA512 269020e23cb885c872f0f7bca7e922399035f6fdd4fb68a9eae80911d2955486b8bfc868c6de3758463bf0eb57d0b5c90787c9eebf5a32d9fc38ce26491c9afb
  • SSDEEP 12288:6cngs+cvhCpAa+RRwKNpqoz74/5D0qokyRv:6gJOf+RL5z74/5D0CyRv
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  stealczgratdiscoveryratspywarestealer

  • Detect ZGRat V1

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2