Extracted

• • Target

    f22b2ffe8faeea30ca4f1c9a3a648d6fcb143632eb3eb55cb753b237cf95fc75

  • Size

    372KB

  • MD5

    0ccad15d16583f7f65cbdc18da2f0c3b

  • SHA1

    434d41183535bcfc710397537988ad220f003e67

  • SHA256

    f22b2ffe8faeea30ca4f1c9a3a648d6fcb143632eb3eb55cb753b237cf95fc75

  • SHA512

    7a4064edc46bddd2f074cd31d55b9d24b1d04df8311059f46db663c6bc62f39e459badc4a0288605a1cf4836ad39de2b45931edae5605005b1285baa39bf9c2d

  • SSDEEP

    6144:CKnC1VEKPHySHREDpdksUZBg7C6vZb/TwZ7LylNK6nhByUSXyYTkJft6:CKnCgaSSxELksMUvlLwZ7LKjJ8kJl6

  Score

  10^/10

  stealczgratdiscoveryratspywarestealer

  • Detect ZGRat V1

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2