Extracted

• • Target

    9fea1c2f587e532b087b59f69d757a8833f9c17816b1189c442018f9848a331f

  • Size

    372KB

  • MD5

    9619c967c8de06a5a79ca4f1c6674108

  • SHA1

    c2d848ec609ee16ce3313485e7878a5509021748

  • SHA256

    9fea1c2f587e532b087b59f69d757a8833f9c17816b1189c442018f9848a331f

  • SHA512

    0f232dcc88a4e95b3458483164037d18f0fd28887b1e9c53e8a5778b8e974c61160ff7ef7af485ae89a80067ecaf8b5a5223cc178e84d57e961d34230abeb9b1

  • SSDEEP

    6144:CKnC1VEKPHySHREDpdksUZBg7C6vZb/TwZ7LylNK6nhByUSXyYTkJft4:CKnCgaSSxELksMUvlLwZ7LKjJ8kJl4

  Score

  10^/10

  stealczgratdiscoveryratspywarestealer

  • Detect ZGRat V1

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2