Extracted

• • Target

    1b96d860921481cc774c4adf05e1688d9a8d6cc7481e9fc24fd9a05b537a6722

  • Size

    449KB

  • MD5

    2713d2fd750f1752932dd73ad4e6147d

  • SHA1

    af58830ec12e543d71ef8523c59b4f9b181f5eb1

  • SHA256

    1b96d860921481cc774c4adf05e1688d9a8d6cc7481e9fc24fd9a05b537a6722

  • SHA512

    7faed9bb59ad843bb4d9188345f4151033af3dd9b4d4c1d456d6bfc9ff7a67db98cddb0feb209a4d91eaeeb878bdebcf859c5639f2b3f56e4421247348ab3d54

  • SSDEEP

    12288:z4kni8/6leIbaECbwZzSSR1tqRnnKPkgq:k7ba7buzVzkRKPkgq

  Score

  10^/10

  stealczgratdiscoveryratspywarestealer

  • Detect ZGRat V1

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2