Extracted

• • Target

    ad11f5e7b6814512829785896c370416c0f7ce733674c2491cb7ac0dd4dce5cb

  • Size

    382KB

  • MD5

    d53e181c12299c4011d0073b9af8cee2

  • SHA1

    b6e03d6b6a2955e25cd61730820b88c57628bcf7

  • SHA256

    ad11f5e7b6814512829785896c370416c0f7ce733674c2491cb7ac0dd4dce5cb

  • SHA512

    62cfe628434da28ca09c53b829200b6d37ed57279efefd34a6e28614466c159d608326a1635d403c65fd3ae0e6ee69a378f429e115e63c6625aa52462097a4b1

  • SSDEEP

    6144:L0NTKE3CDWHhQgoFZHaJtrzQr792AiXQvdUodm7iKMceJK2o:L0NGMCaXoFdAFzQrJviXq3w7IJK2o

  Score

  10^/10

  stealczgratdiscoveryratspywarestealer

  • Detect ZGRat V1

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2