Extracted

• • Target

    0f9ff9981dca95a05ed1175c668eb0b40a7a994818ac15644ae0f6aa7783ffe0.exe

  • Size

    347KB

  • MD5

    d77e47afa9745c340bc9503535afcd8e

  • SHA1

    a2e802b8a569c984ab63ba1c6d7ef84fec43c7ec

  • SHA256

    0f9ff9981dca95a05ed1175c668eb0b40a7a994818ac15644ae0f6aa7783ffe0

  • SHA512

    d914d952d6dc55dfcfcfd6efdfaeed289640923c57503c1f4c3c4ddc05fffece43d3afdb1588f00e2a2cf19692c92da2aee91dc4452b97d96a4ff16d2ea422fe

  • SSDEEP

    6144:ToBqFgnH6oK/xcYNKD8r+syjBJw45rtMLYC43J9fa7nxNHnKTf:EawahCYgD8CsKJw4/MchjCnMf

  Score

  10^/10

  sectopratstealczgratdiscoveryratspywarestealertrojan

  • Detect ZGRat V1

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Detect binaries embedding considerable number of MFA browser extension IDs.

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Detects encrypted or obfuscated .NET executables

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2