Extracted

• • Target

    9e207b9ccdca9e8dcf77295a5ca62e7245f48a9b86b4e8b659d63719a70960f0

  • Size

    365KB

  • MD5

    493cf2ea13df55a095a64e890695cf3b

  • SHA1

    0bec79b9fd343195ad28748bdcfb3a6273487b37

  • SHA256

    9e207b9ccdca9e8dcf77295a5ca62e7245f48a9b86b4e8b659d63719a70960f0

  • SHA512

    db5fcde0ba6d77cb55b08336de8bf1f1b87a742ba1a073dc2e2c8015cf0b961513e1f771ced5c98ff9dd4bdc0c3aafb2f1edfdf84276e65aed9022920657681d

  • SSDEEP

    6144:mfcBWeUkksvXwBbM4HxlzmJp2C5kbX1Z0DR7M1jTs5gYTmWM:mfcUeGzhHxNQKX1eDR7un0mWM

  Score

  10^/10

  stealczgratdiscoveryratstealer

  • Detect ZGRat V1

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2