Extracted

• • Target

    0cbfa31fa201367844ee36b025c2be920882110cae4469b3d50a9df6211023af

  • Size

    260KB

  • MD5

    dfb121af72734e1160e95fc3af5d7d23

  • SHA1

    886c44b6347a51e23d73bf4b13f101ea84837bdf

  • SHA256

    0cbfa31fa201367844ee36b025c2be920882110cae4469b3d50a9df6211023af

  • SHA512

    60e2c3a2c46e1dc7708fd04c548e2ac4ee30434edc000ad90f041862324476a47ad2de850f3c176fa154e3d3a2bbbeb48ddeb1720d7e8d5d81d73b0069cce909

  • SSDEEP

    3072:II0qv0Xpb3g4BJB3ZI+urF6sMBmgtFKpQCqDS8LMC7i7EK4Qbz1gD3NdyBzf6UxF:iqv05b3zJzdpLJ2IK4Q1gxdyP

  Score

  10^/10

  redlinezgrat5637482599discoveryinfostealerratspywarestealer

  • Detect ZGRat V1

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2