Extracted

• • Target

    41e787f5056461565bce0f5d57abe5ec66f24ba3a3a788e1835737afa3d0bf4a

  • Size

    417KB

  • MD5

    e3b28616f9edb6e4c6bbf6b495856b41

  • SHA1

    b3ef76641c0cc8f082fc53f3c9851a1735b36161

  • SHA256

    41e787f5056461565bce0f5d57abe5ec66f24ba3a3a788e1835737afa3d0bf4a

  • SHA512

    00afb7809778b8f1e80935cc560f10d203a57f96404083e53d63d7899b367f50a0588ce9b4f830cc030c4afd7d48e5d9a99818372aa72f3e7acc335fb6bfcfeb

  • SSDEEP

    6144:d5pk6VtVbGU1sVOzp0f1eYVwIuI84glzNwiaTSLrqi3Vta5K:d5pjVLbX0ONzYarI0lzhaT+RVtMK

  Score

  10^/10

  stealczgratdiscoveryratspywarestealer

  • Detect ZGRat V1

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2