Extracted

• • Target

    486d3c5b6cce21fb19837251c91900cb0ac59563db548691ac602b224ff78bc2

  • Size

    450KB

  • MD5

    f243e8d5f030c47e25839f45b8506ec8

  • SHA1

    08c4e046dc5b90ae77b665af6b25783dd9b384c1

  • SHA256

    486d3c5b6cce21fb19837251c91900cb0ac59563db548691ac602b224ff78bc2

  • SHA512

    06561ecd63aafb798d3173d2444fd4a52d67d68e891dd537cd0025fe70910d1955c2b83cda1b664a7df872810e159daf164f07b4a9fe0b4af0c18b32435c2f24

  • SSDEEP

    12288:LG2lUG0NVvKXW/WqwO0YSTPZSeSnnKPkDf:LgVvoU9fsPUeSKPkDf

  Score

  10^/10

  stealczgratdiscoveryratspywarestealer

  • Detect ZGRat V1

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2