Extracted

• • Target
    014b9e28024e10f5347193e76fe7d67614a5275ce63247cc927cb38dd4287038
  • Size 470KB
  • SHA256 014b9e28024e10f5347193e76fe7d67614a5275ce63247cc927cb38dd4287038
  • MD5 28b6c6cd16bd2f4329c0fd7021857a5a
  • SHA1 404713cc2b26d91742968cb47215ef3921350be1
  • SHA512 149a07d81d559ad74643fc3b11bff69d9123006c0c9294a5d1fad55da6b198e1f5103f22e9327bd23b77e2dcf10505c475f3bec186b2ec359d875662fc4d647f
  • SSDEEP 6144:+m+k6f/40CWHskqZzUSmeTWUI4+jwnONJlIm85kcLcr9D8I1TOIq7TDQpjKDeBQH:+ms/40CpCS1TWzmzhoam/6wp2a4Vl
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  sectopratstealczgratdiscoveryratspywarestealertrojan

  • Detect ZGRat V1

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2