Extracted

• • Target

    1c6ec6d8a7d0be8a38b983777a66d3a0.bin

  • Size

    470KB

  • MD5

    1c6ec6d8a7d0be8a38b983777a66d3a0

  • SHA1

    7f4ffaab20d63c5995362ef4defd70c16e8694e1

  • SHA256

    15d74c4748b0157bfb6f22a8fef4471d48eb8091e785cc3ef42ac33f89244189

  • SHA512

    83913967f83c267ac06cf7c9cdb3943083e46fb536071107614bdf750e6bfe1e5f189adaf568bc02174125ac5992545ca8a26d2ed85a94fec1876ddae4750b40

  • SSDEEP

    6144:rXfzbu1V3OQQFQMRxpZL9yZuAGyZUy+4WJKpaWbP64LlwvfVriPF:rX7S1V3hQFQMRxxryZsBKpaaSHVriPF

  Score

  10^/10

  sectopratstealczgratdiscoveryratstealertrojan

  • Detect ZGRat V1

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2