Extracted

• • Target
    91f2dfdf9d688737d07ae80174d5e6a30f6147ce39ebe437ac89460ebdd8d114
  • Size 434KB
  • SHA256 91f2dfdf9d688737d07ae80174d5e6a30f6147ce39ebe437ac89460ebdd8d114
  • MD5 149677290aa8404040c2f2ec8c285e21
  • SHA1 87e8011dc4e5650043062ef9f53de7a4a0531f1d
  • SHA512 d14a49d2698786fe8b7361c349937f319b613b8be8c579ce641fe2786031ec789cdd6c8b9f00d1cd0729662fab30aedba5885f262dae93dbfaeb0dc11bbce12a
  • SSDEEP 6144:YjCWCQdVWjXWRSltCvyKN51/jFU+piWhXCS4W6N2sPyOG+V81t6xjl:u5/WMPZ1/jFU+pi8XD6NUD8xjl
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  sectopratstealczgratdiscoveryratspywarestealertrojan

  • Detect ZGRat V1

  • Detects Arechclient2 RAT

    Arechclient2.

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2