Extracted

• • Target
    f0c78408b8c12a80cd9b962bb269a708c11d75f7d10557ba591c122402784999
  • Size 480KB
  • SHA256 f0c78408b8c12a80cd9b962bb269a708c11d75f7d10557ba591c122402784999
  • MD5 5faa3957230d3df53abd72d6f1651630
  • SHA1 d1efa75ee6e0f403cd09f3d383ca6484678cc147
  • SHA512 3fb5c731c6c5e46b7ad42d657528e6ce8e35efbc4e0d347758b38d77ebb3dc952ffc4f1e3d5c46d513310c3cc7698f8bd78feff88caa57a99b20025ebe2db0c0
  • SSDEEP 6144:+hKjDowtqWhQMhhoo+nSHsQAnAkDQvCAIXdsZiAEXIv8u11003S47q:+hKjPBhQMooHhkDqCAIXds2YvR3S47q
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  sectopratstealczgratdiscoveryratspywarestealertrojan

  • Detect ZGRat V1

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2