Extracted

• • Target
    84aabb05fa24bb4994957177e3721ed6666aadd821b63360ac4417009dfb7db9.exe
  • Size 451KB
  • SHA256 84aabb05fa24bb4994957177e3721ed6666aadd821b63360ac4417009dfb7db9
  • MD5 7f7e1c02807a2ac57f765a80b3ae2dde
  • SHA1 07139ac51e6664319c8f3490796f8def8ae34660
  • SHA512 c3ccfb2852bfba2c3f2cf53336a42d18ed96096ed2aabbd1084e8fd48e447303b30a3109199e784afab8e1fd9cdc8e327a653664c6897c863c37dbde1ba46eaf
  • SSDEEP 6144:NeMRwnTgfMmxqWWKFj/T/WpiCWy6P/cWRk2HdZdqte0w+fFaOs2jyjaUL:NzRwnEfMmxqDOj/DBJcHM7ZKtm+gaUL
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  sectopratstealczgratdiscoveryratspywarestealertrojan

  • Detect ZGRat V1

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2