Extracted

• • Target
    b4af926f2adf9e4e07f10cfb9b8275661c8c8d326fc6943cc4dd49d6aa068738
  • Size 466KB
  • SHA256 b4af926f2adf9e4e07f10cfb9b8275661c8c8d326fc6943cc4dd49d6aa068738
  • MD5 a7274e414d8e1d6e894582e91c385677
  • SHA1 3e04c79838055781efc54c27e268891e80bb6d61
  • SHA512 3ae452288f610e5a2b224c2be3f21c1ea6bb7b32133012f27e1c70c80a5fa9f4ae56da5d02bc0ad2df0f3916fe6653eba3e1492e42be6142da206b47ab0b533a
  • SSDEEP 6144:axRUJWrM1Z2t2IETRfu2YIgJgKkJp7Glj1WblHSYegS4TMcb/1g9oNjfJls1zxtI:axjrMCt2m2Fg+KApGlj1SlHhaGNkoqL8
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  sectopratstealczgratdiscoveryratspywarestealertrojan

  • Detect ZGRat V1

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2