Extracted

• • Target

    9c433f259204120dfbfb83fdf8b5d460_NEIKI

  • Size

    450KB

  • MD5

    9c433f259204120dfbfb83fdf8b5d460

  • SHA1

    0d4d2165eac742011b25a189bba480fded7998f2

  • SHA256

    b1418bf6e6a65b88b7ab7eff05553f9cb656909db4c2ecba1ee79913a781702c

  • SHA512

    75b2af6987e706c93637b0f0641a9d06c587a555d7df2220a39743ae65a04d6443fa8b7046f67ca5ac26c87e27d22f5c1af72bb0b542ec1c22d509fa63e0ee47

  • SSDEEP

    12288:LG2lUG0NVvKXW/WqwO0YSTPZSeSnnKPkDc:LgVvoU9fsPUeSKPkDc

  Score

  10^/10

  stealczgratdiscoveryratstealer

  • Detect ZGRat V1

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2