Extracted

• • Target

    991e13cb726297c197cef44a771e0f79b3f1669ee6c9fd1dffcd60a66c784772

  • Size

    365KB

  • MD5

    d88ed646b49723f7bc0a11e8141a3cac

  • SHA1

    e91853aad5f1b9c658df0133370c7d23694fb7bb

  • SHA256

    991e13cb726297c197cef44a771e0f79b3f1669ee6c9fd1dffcd60a66c784772

  • SHA512

    a8a72c8564576aceedfdf47fec25dfbba3602ad82ab80dea4a8564c933fedffbb7e35333dfb55c482114c08913ad26074b51612fa35c60a0233a22938bae6a76

  • SSDEEP

    6144:0j9PNW6k+7KXF5gUZwnAFpPLr2PXEVT1NjGzG4YqJcbbYTOO/:0j9PA6d7K4UZwQ2Xw1mt+b8OO/

  Score

  10^/10

  stealczgratdiscoveryratstealer

  • Detect ZGRat V1

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2