Extracted

• • Target

    4bcdf33d99a5429e0b6e6f754ef11010a1df4d3925c2df8a28997c2b9069db80

  • Size

    383KB

  • MD5

    3d7127a10409c3f1b775c80238bfcc89

  • SHA1

    143720d2d3e591f0e6877b410d9c8e667b080ee0

  • SHA256

    4bcdf33d99a5429e0b6e6f754ef11010a1df4d3925c2df8a28997c2b9069db80

  • SHA512

    83c13ef27883f38f8294235bfc7655d4c19b803a7b65f725f4fcd21704ec59b1522e6a0fe67571b354cfa32b031719ae633a63bfd2e90eb4c84dbdf0f33b30da

  • SSDEEP

    6144:0wUnEcZwBa7zsNtiNSm4G6GL8yLPRlbxwHzT9L2EJ2iA179uVWQj9eJK2q:tkEMKYd88wP3JAhIjUJK2q

  Score

  10^/10

  stealczgratdiscoveryratspywarestealer

  • Detect ZGRat V1

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2