Extracted

• • Target

    409b0e41b78f8b2ca44ffbbdd291a58f0a3ca62cc046b5d5e607ebd0e077cfd6

  • Size

    383KB

  • MD5

    00c2ceca99b1088bc1356f709499edae

  • SHA1

    a7ac5c3b981d11df14294e4a60283216a71ff9cc

  • SHA256

    409b0e41b78f8b2ca44ffbbdd291a58f0a3ca62cc046b5d5e607ebd0e077cfd6

  • SHA512

    79107aa7e36e5f2f8af091e61ea1b4d441eb2914184b6ee9d8365b175a90304d03baacbcbb8c58cc7f5453fcb523ed5d73ed6e53cfd910b616a89f7a759c1358

  • SSDEEP

    6144:0wUnEcZwBa7zsNtiNSm4G6GL8yLPRlbxwHzT9L2EJ2iA179uVWQj9eJK2l:tkEMKYd88wP3JAhIjUJK2l

  Score

  10^/10

  stealczgratdiscoveryratspywarestealer

  • Detect ZGRat V1

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2