Extracted

• • Target

    1933cc96d868b2f828079f50fc38bf5d3bba7394366a177ede4f2409ad7fd79e

  • Size

    416KB

  • MD5

    b23dd99107bf4f153ff538aad13e2843

  • SHA1

    d440056bc2a643de694c503d0af03683406759a7

  • SHA256

    1933cc96d868b2f828079f50fc38bf5d3bba7394366a177ede4f2409ad7fd79e

  • SHA512

    2cb901af016e9b47b6674f6464eba15759c5605ab91228da622b9494eac58ec2ae6e40d1c126b424b049795c630f804042c92c72e2d5de1db0af9f5f24412c31

  • SSDEEP

    6144:Is39oglCbCdvUevlzUusNjv80uIGK87Veb4Ow93mKWLZmuMio:Is3+Ypvl5cv80FGKkOwStmuo

  Score

  10^/10

  stealczgratdiscoveryratspywarestealer

  • Detect ZGRat V1

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2