Extracted

• • Target

    6a215ea22e985683e232334a3b8518d91c4355f686c157bdec99c2f7d87645fd

  • Size

    382KB

  • MD5

    00e81116ae5db5442e3059a4752ee035

  • SHA1

    805977bc2c66817ea08309b06af3653a81294754

  • SHA256

    6a215ea22e985683e232334a3b8518d91c4355f686c157bdec99c2f7d87645fd

  • SHA512

    4c5596618ce8a1fb8b282d60c3ed2236f4f33834b800f29d195730fbbf3230cea5c25413712b6ef725281894ddaf92a0e9a61f1b8199facbabb4379bffe381b2

  • SSDEEP

    6144:L0NTKE3CDWHhQgoFZHaJtrzQr792AiXQvdUodm7iKMceJK2v:L0NGMCaXoFdAFzQrJviXq3w7IJK2v

  Score

  10^/10

  stealczgratdiscoveryratspywarestealer

  • Detect ZGRat V1

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2