Extracted

• • Target
    6f987f25272a8800fc7530836cab635806c2b6a8ac5963d6179cb194817cfa3a
  • Size 478KB
  • SHA256 6f987f25272a8800fc7530836cab635806c2b6a8ac5963d6179cb194817cfa3a
  • MD5 464226afb511d010a5c018f2378b941b
  • SHA1 139d776476fd749c5ff4c12de520443841ec4c6e
  • SHA512 bca6067fdcbf65879b88ebe9865055c16e3481a07dd55d891d91ab4a42330a413d7885e159c6320ee0c0cbf1d65c5de5cd4a9fab8f4ea89a962a8b68831f3213
  • SSDEEP 12288:gOP8W4WCijCGpPVr7/Is7Yp/4UIAR2eCbVfuV:gOyW5jnFYi3JhfuV
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  stealczgratdiscoveryratspywarestealer

  • Detect ZGRat V1

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2