Extracted

• • Target
    ad73f8e5e589a55e5e7f61904350f40dccd7a9e31a2a3c87d148d442c2adeccc
  • Size 395KB
  • SHA256 ad73f8e5e589a55e5e7f61904350f40dccd7a9e31a2a3c87d148d442c2adeccc
  • MD5 6cdeb54bee9bb79a14676d7f576c514a
  • SHA1 6c5c9d331270653ee45d085c528ede5c6de2fe0b
  • SHA512 64395927ceb95d9893f273a333fe9b9a4a835772bcebafb7b2f78da4aa239af85cefdf8e8027f01004e2c501a7a5a58081d17d2aaff2fafe7e3a4b738b6c1e47
  • SSDEEP 6144:P29OmUzW8qsGKCjyUeQ3KSJJHr1kWhr12uKej6RCM+8RPF:P2R67JCeU13K8JH1ZFKej/81F
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  sectopratstealczgratdiscoveryratspywarestealertrojan

  • Detect ZGRat V1

  • Detects Arechclient2 RAT

    Arechclient2.

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2