Extracted

• • Target

    f367d6cd435d84c917faeec225530d6fa4daa24886d8d0edf1c28fa012a18fa4

  • Size

    365KB

  • MD5

    36fc09c0719b19c6c3e07656d8acb335

  • SHA1

    6a980d013e2919f8a0f0610e4dc074453aeb93ac

  • SHA256

    f367d6cd435d84c917faeec225530d6fa4daa24886d8d0edf1c28fa012a18fa4

  • SHA512

    69088b3ac134f253ca33a28f295a961cd2c5995d605f136e3771ea04e896c20822285cc1d9c29ce8293db083bcd19a3f8f889ee924a090661a8d61e302e31f93

  • SSDEEP

    6144:0j9PNW6k+7KXF5gUZwnAFpPLr2PXEVT1NjGzG4YqJcbbYTOO8:0j9PA6d7K4UZwQ2Xw1mt+b8OO8

  Score

  10^/10

  stealczgratdiscoveryratstealer

  • Detect ZGRat V1

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2