Extracted

• • Target

    816eca8281427fb942e2aa991411cc46.exe

  • Size

    260KB

  • MD5

    816eca8281427fb942e2aa991411cc46

  • SHA1

    c6f7ec6ea98dcdc10d069f041993a327f7179fb5

  • SHA256

    54db892f3b197776a0a7e9dca3fad125b662416f0762a19937d537b7d524d38b

  • SHA512

    83059181f2a8cd69dbaeacd25cf7722cbee8760f7319953a11a10afae37118f7d9d0ec405240816750939a5a5881a5a69dc723dcc4457e74480e36eeab4aef67

  • SSDEEP

    3072:sI0qv0/tb3349JB3ZvYIisC2BRWcCeB6PMbVY3s6x9REw29uJaI9CCN0kRcEa6UT:Gqv0/tb3GJzC5P0Ct29IaRcw

  Score

  10^/10

  redlinezgrat5637482599discoveryinfostealerratspywarestealer

  • Detect ZGRat V1

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2