Extracted

• • Target

    cee4d31ad738a2f442cac136c23afc2b925c96e175847287b1e8348a52b816e2

  • Size

    440KB

  • MD5

    eae8889cd9008b17e04de05127d02907

  • SHA1

    50ff7b18a2d6831f5857b35a273828d51f474805

  • SHA256

    cee4d31ad738a2f442cac136c23afc2b925c96e175847287b1e8348a52b816e2

  • SHA512

    92e29759532002877c191e1819c2d4c85521605c6214c55449cc94e58bdbf8256ad5d8f6428bc9f6269e95d06f74d1f417b889df2199e69696f14d147dcadb6e

  • SSDEEP

    6144:L7N7Lc13hvoeeCGhKtaBJe8U7x2TampVQzZCR8h0fbku9LuTGP:L7N7YTo53ji8U74TNpVQdCR8+BLKGP

  Score

  10^/10

  stealczgratdiscoveryratspywarestealerbuerloader

  • Buer

    Buer is a new modular loader first seen in August 2019.

    loaderbuer

  • Detect ZGRat V1

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2