Extracted

• • Target

    26e67fd264371701c3b7e0e2ada30980_NEIKI

  • Size

    416KB

  • MD5

    26e67fd264371701c3b7e0e2ada30980

  • SHA1

    b4e80344ab76faf4414982d79b7ad0307264412c

  • SHA256

    6ea0b55bd9ae6db1e9a74279e4e647f2d203fa43f05bf4a853882bf3d3779374

  • SHA512

    b587a1b860e3bf594621082b899e44912749654021269d0738def79d4247ac7778e4ed2bcd8fe49d9e0435b543c12b56b72816e1e5cf7be6292b8686259f009c

  • SSDEEP

    12288:t3qzdg7K81Yszs4M1+KsjHhuYWa3KtwrSAPt61:MmZYR8jHhuYF161

  Score

  10^/10

  stealczgratdiscoveryratspywarestealer

  • Detect ZGRat V1

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2