Extracted

• • Target

    d6edd6b42304df203de2bb75c0f54037c5bbd7d71b7e95880b8d7e6f78c0914c

  • Size

    449KB

  • MD5

    6bcc8149bc90e71353af02acdaa7eb0c

  • SHA1

    9e924e59f0f40d52b1045effe23704b1645a4708

  • SHA256

    d6edd6b42304df203de2bb75c0f54037c5bbd7d71b7e95880b8d7e6f78c0914c

  • SHA512

    cdea49349ba34cca55ae1c19c47b79d38e2d724d59c0697e1cf993131295a88407698aa7fb13e38f3357aeb2718469d0f263b63ebfcc451aa39c2ca441e5ec65

  • SSDEEP

    12288:z4kni8/6leIbaECbwZzSSR1tqRnnKPkgv:k7ba7buzVzkRKPkgv

  Score

  10^/10

  stealczgratdiscoveryratspywarestealer

  • Detect ZGRat V1

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2