Extracted

• • Target

    9c4f9d4d6d4d6fbb87de616e5cc4677f2742e4d09d313aae95dc41f1a96c2571

  • Size

    364KB

  • MD5

    d916c4ede41cf6b9ca2bdd7bd4f19005

  • SHA1

    31c6d1f4876eec95862786ef6d993347fbfc656c

  • SHA256

    9c4f9d4d6d4d6fbb87de616e5cc4677f2742e4d09d313aae95dc41f1a96c2571

  • SHA512

    ccefa722cbf9b9062eeaf9730a0eba45e23ee3f6a84eba9423eefdfb6c812342d1634d52ea265e8a65592694cf015f1f31e12760ec46bcbe65aa323377cb9e68

  • SSDEEP

    6144:9HjGRWK3W3yK7lKM6FBEwOaIbJp4U/BKfL/z22v2qDx6Anq4Ndy3YTDXgP:9DGEK3WiK7UMCbm6bfVDxrntTDXgP

  Score

  10^/10

  stealczgratdiscoveryratstealer

  • Detect ZGRat V1

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2