Extracted

• • Target

    be6b4ac04f80a887bfc1dbe0d98068b168141c33dc1c8da4e1d5daad4531f3f0

  • Size

    365KB

  • MD5

    894ed2226cced5540e9589e4392dd104

  • SHA1

    4e608b032fd76b79db2c0e069f381d5917d56579

  • SHA256

    be6b4ac04f80a887bfc1dbe0d98068b168141c33dc1c8da4e1d5daad4531f3f0

  • SHA512

    9ae80b57a0160efbe304e3bda859e6d263bef0105ef90b63aa59f1957759653d82aaeaaecb35ba6b5095f40d3ca431ff10f3978bb1783958210a68500df2da68

  • SSDEEP

    6144:PaX7EMN6qa0aDkM2fzyL8uD1OQma0Ow9bcip87002dK8:PM5NKPkM2fzg1OiFt7FyK8

  Score

  10^/10

  stealczgratdiscoveryratstealer

  • Detect ZGRat V1

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2