Extracted

• • Target

    591630952ac39ca5a49c867611677e0d66b67cbe57c5940689eb517b46b455d2

  • Size

    260KB

  • MD5

    36721cb2a0ea5d03ae99b60a775b2a45

  • SHA1

    270eb0d5f0f519345804c2e42167f22532189938

  • SHA256

    591630952ac39ca5a49c867611677e0d66b67cbe57c5940689eb517b46b455d2

  • SHA512

    b2e70854b1c508473111c3f999cb9192c2ecdb6a482072717e75d6b6a24b1d1acfc63bb82cb0066eafa61500ef7f8aa6b163f08e41782a2bc9e8015ea3a9c07d

  • SSDEEP

    3072:5I0qv0cb3F4+JB3ZBkn9BIsxoKEln/Gta5jDwyXLoFU1WGOo/z/kUPD6UxF:Rqv0cb33JzSDElnUWsgpOSz8q

  Score

  10^/10

  redlinezgrat5637482599discoveryinfostealerratspywarestealer

  • Detect ZGRat V1

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2