Extracted

• • Target

    3262a1dad8a0f03c385c148dc837e6481e4cae057387d44df22b3767e7180f82

  • Size

    260KB

  • MD5

    652c95dfaf6db3f6f850ff655887f5f2

  • SHA1

    cd545cbaca9eb001827aba25210f331e1f38fa72

  • SHA256

    3262a1dad8a0f03c385c148dc837e6481e4cae057387d44df22b3767e7180f82

  • SHA512

    0ba8f5fb434f962d87b6d046b8c4acbcdcd446e138eb6a8884967c15ab252fc888852cc09da73f2a234526910973be2a368124d6273377546b103f1b80c2c6d3

  • SSDEEP

    3072:II0qv0sob344TJB3Z0e07kss4k2NSZSVQtgFglb0X3Ul0gPEO5mL5NNbBJ6UxF:iqv0sob3dJzPIIZSV8jb00l0gP35mrL

  Score

  10^/10

  redlinezgrat5637482599discoveryinfostealerratspywarestealer

  • Detect ZGRat V1

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2