Extracted

• • Target

    00c8ad5cf559378352a5026859283bfffee17e56b14a6f96f9fca08efa18ea84

  • Size

    383KB

  • MD5

    01fe5b410c9d85a5431da8d6c17d6fb3

  • SHA1

    f432252efe31abea1de4982d29a6d0d493dd4474

  • SHA256

    00c8ad5cf559378352a5026859283bfffee17e56b14a6f96f9fca08efa18ea84

  • SHA512

    db24630932f8b14862ac455a0e22d4c44d341e6e0d54aff01875ba506ef8f31237f088806a4756f418ed9f5e405f77de519f99661ced20d393ff0e34422ef7bf

  • SSDEEP

    6144:0wUnEcZwBa7zsNtiNSm4G6GL8yLPRlbxwHzT9L2EJ2iA179uVWQj9eJK2s:tkEMKYd88wP3JAhIjUJK2s

  Score

  10^/10

  stealczgratdiscoveryratspywarestealer

  • Detect ZGRat V1

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2