Extracted

• • Target

    ebd0b0b8036b17fa840e69cce9acdc5cc93cd42872c8f6026b6957daa8f98aee

  • Size

    384KB

  • MD5

    51308e15f35cb56cfff9cceac055db31

  • SHA1

    416f74185e606383fca384eb44d6c3d513287f2c

  • SHA256

    ebd0b0b8036b17fa840e69cce9acdc5cc93cd42872c8f6026b6957daa8f98aee

  • SHA512

    a40c121e81cd0222e98c6aa433cb1decbfed2d3c578c11c16bf1271d584461839153e894f9c7b982cc1027b09b2f547a05cd90a0688c8e89fd53d3ece6fb10e4

  • SSDEEP

    6144:ujfcaXBXkd86TbOMLd1KsPTNqG5Tcq9kdilO1SnO3IExK:87XN6T9RpRAq3O1SnQ3K

  Score

  10^/10

  stealczgratdiscoveryratspywarestealer

  • Detect ZGRat V1

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2