Extracted

• • Target

    cd54b20bc9cb3de619478bce043578ba0cb1dbabd6ba736d139b42177be4f67d

  • Size

    407KB

  • MD5

    3341b8143237f90be957bc0e9d349119

  • SHA1

    85e1092c18a01c05a72d8a14d015313f1343d26e

  • SHA256

    cd54b20bc9cb3de619478bce043578ba0cb1dbabd6ba736d139b42177be4f67d

  • SHA512

    f6162e7d51c4dab6ae059231ded1fda9f51773633d5799b3dd3a76673e4adc3685022abb44e4cd9598d6eb3613d7731a4c26c81ff06512ad3ef9f05e63f33210

  • SSDEEP

    6144:TRJCasp2zJZshZ3ZBtPeWNk/GW5qqSODl+40hwxv:uaVYPnYAqwp2xv

  Score

  10^/10

  stealczgratdiscoveryratspywarestealer

  • Detect ZGRat V1

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2