Extracted

• • Target

    683fc3a92e9e14798ea87fddef2f2bcf9e548758233bff0ca3267a71741b3d13

  • Size

    445KB

  • MD5

    80a4caed5d40489be77cb54617a91de4

  • SHA1

    51a1ae13862055f86993ea9ffb4036b4d911d79c

  • SHA256

    683fc3a92e9e14798ea87fddef2f2bcf9e548758233bff0ca3267a71741b3d13

  • SHA512

    7dfe4b0fa47314f72af8378efccc1b32585ff3c348f4cf9de60a7411f020115fc277074d2a23f017b10774d38f53ade15b6db4943326563644f525576d253f37

  • SSDEEP

    6144:4DB3yaQTpQbjXidskjQ/K+VhYNUKD7ZCtAu9hZlpw/21:qBtQdyXy0XhYNdTu9Npw/21

  Score

  10^/10

  sectopratstealczgratdiscoveryratstealertrojan

  • Detect ZGRat V1

  • Detects Arechclient2 RAT

    Arechclient2.

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2