Extracted

• • Target

    bc0830b3d105954fd3a9361a230fcd39dc3e1fae9de5ab65314db1917a5ba702

  • Size

    372KB

  • MD5

    e77e0b96b07fde5744943779f76e7295

  • SHA1

    c1c7ced8c4ef15311d1dbe27625fd9f29953bb73

  • SHA256

    bc0830b3d105954fd3a9361a230fcd39dc3e1fae9de5ab65314db1917a5ba702

  • SHA512

    2aa78c3060dc4c4e8e1dd71d2e7aee1754b0a2f568bd635737e5b25709715cffdf77c328f2b1bf97fb0b9787fb00a2410a31511ba0e59148e5878d67dbe92b91

  • SSDEEP

    6144:ipFxc1jv9NVJYCdB7H2CatlcKxtgIxvO6nuotVmUn5f9MyEITzvT7l:ipFxQVTJYcB71YtgIxvO6uorDTL3Tfl

  Score

  10^/10

  stealczgratdiscoveryratspywarestealer

  • Detect ZGRat V1

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2