Extracted

• • Target

    475196d8e135d9ed303c2ebfae483c206c442b786b171fc732e1fe0030447a8a

  • Size

    383KB

  • MD5

    f1fd8b0c4b6831b01c470769c5c920f5

  • SHA1

    2e2135052c90491000e0c3bfbd79aa7dfa75b67f

  • SHA256

    475196d8e135d9ed303c2ebfae483c206c442b786b171fc732e1fe0030447a8a

  • SHA512

    43fc385c9dec2f2094cde3078e861e8d1f25e0766d680b4a84ef7d3d568ed7020662e82c6e489d03d82f403a7d54c0567d98707c23370c0849fc859a25b63361

  • SSDEEP

    6144:0wUnEcZwBa7zsNtiNSm4G6GL8yLPRlbxwHzT9L2EJ2iA179uVWQj9eJK2o:tkEMKYd88wP3JAhIjUJK2o

  Score

  10^/10

  stealczgratdiscoveryratspywarestealer

  • Detect ZGRat V1

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2