Extracted

• • Target

    48449f2a6be4b1c6ac80923f21a28a9336e759ba1bc15564c057a464f01e5dca

  • Size

    368KB

  • MD5

    6a4d3d2cb5afb4a094be9cf830f8f7e5

  • SHA1

    1039d1fe3203ff067e591f5eff0f9a1cd8aec6a8

  • SHA256

    48449f2a6be4b1c6ac80923f21a28a9336e759ba1bc15564c057a464f01e5dca

  • SHA512

    44c8a54a5b847295cb3122f5cc1824a3fe4e71ed8cba2bd1d5f6ccbbbdfa5c37dbb3343a7ab1d24d41064602e14004a4d3132ec6c4bd4a67d406153a8c52d77b

  • SSDEEP

    6144:/jRhVhZVNlrECRfaajfnwdgcXlzbrp5nkaALQf4jTfeV:lrLNrEWCazK3XFh5vALQUfeV

  Score

  10^/10

  stealczgratdiscoveryratstealer

  • Detect ZGRat V1

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2