Extracted

• • Target

    f3726354e28831c42bf1f24e79f02906b7ef038815351ed2b6ff0d769a99c8a3

  • Size

    260KB

  • MD5

    ff3fb9bb9fa750c86097dc6da5ffdcc5

  • SHA1

    3a30f704a8d12c459a9d697a0b77d96de633249c

  • SHA256

    f3726354e28831c42bf1f24e79f02906b7ef038815351ed2b6ff0d769a99c8a3

  • SHA512

    b1b7dd69b69bd6b944da9bf934c4eb8653ad7c6e2f6b80369b3258d5eb738a76809576102eca7fcaf4dbe6d346c3ec2864e2584d6643ad4b56b7d2cc5a65a881

  • SSDEEP

    3072:bI0qv0Seb3m47JB3Zt/FBsyY30wmk1AnvA0nUsCwNGPt+5OnHDc2N1HIsdN6UxF:Hqv0zb3PJz+BAnY0nd7sV+5KDc6bf

  Score

  10^/10

  redlinezgrat5637482599discoveryinfostealerratspywarestealer

  • Detect ZGRat V1

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2