Extracted

• • Target

    9742004629e0fd88ab25a197674ff01f6553feb8781adc7549f2b16a3eb704d8

  • Size

    382KB

  • MD5

    d3b03da8cc7dcf4d1382156cb005a36e

  • SHA1

    b9a8fd0151345adadd318b688295e267a55284ab

  • SHA256

    9742004629e0fd88ab25a197674ff01f6553feb8781adc7549f2b16a3eb704d8

  • SHA512

    64733d56c806a3b94b569eeb12fc709477f87b0c75a1255d1c559dc7495642f4a365615e40275d50d861b7c8c7ab180c0173ab5eedbd9709fb43a56d5e1e1a53

  • SSDEEP

    6144:L0NTKE3CDWHhQgoFZHaJtrzQr792AiXQvdUodm7iKMceJK2q:L0NGMCaXoFdAFzQrJviXq3w7IJK2q

  Score

  10^/10

  stealczgratdiscoveryratspywarestealer

  • Detect ZGRat V1

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2