Extracted

• • Target

    3bfa23ea6630847ebf86f2fb19709ef7d289eeea0849b5cb81f25e3366c1a714

  • Size

    382KB

  • MD5

    0be517a3810d35571ff7c996721578b1

  • SHA1

    1fac3c40ff1e740aba94eab89e065baabd88b3b5

  • SHA256

    3bfa23ea6630847ebf86f2fb19709ef7d289eeea0849b5cb81f25e3366c1a714

  • SHA512

    917cb07c980d604f0995ef2aa9b7e62f73d9f85797e14f8a76ab9be2dec51108c63b71eca9168d9a2dd7b32f65b6cdb565d2c9098c4dd48ab573e7f7cad553d5

  • SSDEEP

    6144:L0NTKE3CDWHhQgoFZHaJtrzQr792AiXQvdUodm7iKMceJK2s:L0NGMCaXoFdAFzQrJviXq3w7IJK2s

  Score

  10^/10

  stealczgratdiscoveryratspywarestealer

  • Detect ZGRat V1

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2