Extracted

• • Target

    d49472a9a9abd1f27b0200ac71a6bd80_NEIKI

  • Size

    372KB

  • MD5

    d49472a9a9abd1f27b0200ac71a6bd80

  • SHA1

    7c48d497b1cca1d753f357d828eb1d2ceda6908d

  • SHA256

    a4896480adaeb05564bbde92150c23eeb25c0bfee294795ebfea586014d7450e

  • SHA512

    d994fb6fb64334f4e6f598785b802eb79c2be36b61281b5b4eb4204f8ece7e488e5bc9eb02ba5e03fcbf91b23a93ab718b4bfa5043fb6cd447d86efae744d843

  • SSDEEP

    6144:pl+08UGGfdzF7qxvwcB793ituNKkzXwGZTapf:p808UGgdtqrhauN3Xwwapf

  Score

  10^/10

  stealczgratdiscoveryratstealer

  • Detect ZGRat V1

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2