Extracted

• • Target

    1ba16c90f3137d27500635b96086c7f39cfa5b9a6ab9cb9addd9cacc01d04a24

  • Size

    373KB

  • MD5

    dd3afb246c2875d52769efa8deb03c8f

  • SHA1

    507fa9ea80e6a6cf18511a31cbdae512749e78a3

  • SHA256

    1ba16c90f3137d27500635b96086c7f39cfa5b9a6ab9cb9addd9cacc01d04a24

  • SHA512

    978e660f322d778a4ac944e2756d783872a721403a61d332a1f4a581f4c19c0d204a31a1bb76bedc5ed6dcf67844204bc8b904835aac4c861429a49cce470d46

  • SSDEEP

    6144:AgXLk9lsA7WNFchU6wxpMoyZVn4lt2DSTZATjxhNUP2uxZ698Obd3Tuto/:AgXLk91ar1rKRn4lAQ+1hNUOr9HxuS/

  Score

  10^/10

  stealczgratdiscoveryratspywarestealer

  • Detect ZGRat V1

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2