Extracted

• • Target

    0e392f291da6999d5879828d731ebcbef8b2ad7b3ca77d6e7308de3f817311fc

  • Size

    260KB

  • MD5

    5fae0d85fea444f720fe41b6162ef232

  • SHA1

    b472b3f53be0ab9856317fac8eb7f06aee300730

  • SHA256

    0e392f291da6999d5879828d731ebcbef8b2ad7b3ca77d6e7308de3f817311fc

  • SHA512

    dddc03e6cf1cab20c93a3fd953ddb2e26f0e6f4c85ffa1ce71f8c202f593e367e6ebc3c41085b26d3ca3f8f52716695bdacb443d81689ef2544a44d5d760e201

  • SSDEEP

    3072:Ss0qv0Db3ercHXtcQJR2X8dsLNhv+Vybtif3lql/v3U2eQkl+iyyuoeOWCpUxF:Eqv0Db3R3tzJRWvMNqNU2Tliyyuoen

  Score

  10^/10

  redlinezgrat5637482599discoveryinfostealerratspywarestealer

  • Detect ZGRat V1

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2