Extracted

• • Target

    92e7a9f7696f57e49ce8b75842db90bd6e827119e1864693b2c4d4b59e1ea16b

  • Size

    438KB

  • MD5

    dcb197eee01d724eb2d384bc20a56835

  • SHA1

    c71cf864b7294ba3b916a52301490c8a276ef019

  • SHA256

    92e7a9f7696f57e49ce8b75842db90bd6e827119e1864693b2c4d4b59e1ea16b

  • SHA512

    332273bb95c3ca9181e9f8bbd29deabbd1239669a5e2c5848ea316f01753296d295890ebaa81be4631069eaeb200c838e3097a6309f17aeacdd1e7e1c4862ff8

  • SSDEEP

    6144:OqGjek9bnH1xmXt/lk80aaE72OZjj8C+0jTCBDPduTPQ6sdVjQr5tvwv0:75yoXQ1aaE72ajjxjTC9P4TPCLjOtw0

  Score

  10^/10

  stealczgratdiscoveryratspywarestealer

  • Detect ZGRat V1

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2