Extracted

• • Target
    0e778abce3af4d6b730abbdb4e8298f1.exe
  • Size 415KB
  • SHA256 ee29e3aad14667b58642d965a332ffe5586ee1a2d8a09b2da7a54520b46d598e
  • MD5 0e778abce3af4d6b730abbdb4e8298f1
  • SHA1 70328968ace6d342bd0f48ce42c768fac565cf51
  • SHA512 eeb0ffbafff6784e90c82c9a3ef8d504721a6ac5f5e3e12b0e5c3895cbfd471b385c832051f459cd275b36ae5afccab5af32b1d87287d87064fe1851e7379ae6
  • SSDEEP 6144:YKkvQFITU9Ldd19xaz94FF9CbCix9/iJSiROJPnmTxUhJrI:rkv0ITU9pDq0LC+49aJSYOPnkgI
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  sectopratstealczgratratstealertrojan

  • Detect ZGRat V1

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2