Extracted

• • Target

    c76f9415cebd74a20086f21fabe385f8cc70efca798fd89176125bad770ba695

  • Size

    365KB

  • MD5

    4a4a9f6df96c5a55a8ed433caf274d4b

  • SHA1

    80342cf02bbc35a5d2d86a9833cba0ddd07db6bf

  • SHA256

    c76f9415cebd74a20086f21fabe385f8cc70efca798fd89176125bad770ba695

  • SHA512

    07dc60a192b4d3d9592dab218149e9133efb5a05c448eab7647dca1d3e2e81f2054c2fbbecd9d1e44a26e9bb511bf234d84822a210599146fae172c8e9a1a09a

  • SSDEEP

    6144:1/yLAzjI3/kXehHDXHmlk+gdfmXHduMiFScdOVMJVGga06LNH4THWM:ZyLA/IPkXehHDXGnghm7YSUOVoVcVLNC

  Score

  10^/10

  stealczgratdiscoveryratstealer

  • Detect ZGRat V1

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2