Extracted

• • Target

    b21236873589e7a87443638329edc4d16f6f56a48ddebbba3d5ccd0e9401ecbd

  • Size

    365KB

  • MD5

    b1dec1297755fa5d0dd45742506cc365

  • SHA1

    8129aab6ae529b053cf2e7ef82cf25108789b0bb

  • SHA256

    b21236873589e7a87443638329edc4d16f6f56a48ddebbba3d5ccd0e9401ecbd

  • SHA512

    04bb173e13e0848433a1b638188d0c6981f570b00534836c09833528d7bf44f61d813b3132d0288f8c594402b65b0172fc8078d7eed1d39384ed35d8d9386987

  • SSDEEP

    6144:0j9PNW6k+7KXF5gUZwnAFpPLr2PXEVT1NjGzG4YqJcbbYTOO1:0j9PA6d7K4UZwQ2Xw1mt+b8OO1

  Score

  10^/10

  stealczgratdiscoveryratstealer

  • Detect ZGRat V1

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2