Extracted

• • Target

    e605c40a0878931237c4aa1e78e8395d8a7f9942dfe1387a982002b836b0e55c

  • Size

    373KB

  • MD5

    bee42630dfcbe46ae313fbe6002224dd

  • SHA1

    848b3ace2f6cf4b95d3447837aae91d362ec158a

  • SHA256

    e605c40a0878931237c4aa1e78e8395d8a7f9942dfe1387a982002b836b0e55c

  • SHA512

    2bf6ca66d40c3902e02735ec87c93eebde4eaaef3fb5925e8797e4826a16fa2a08f3d7658afd6ddffb7c614cf95b5d3267719c8d4bd3e621fd1a50ff4d1b675d

  • SSDEEP

    6144:AgXLk9lsA7WNFchU6wxpMoyZVn4lt2DSTZATjxhNUP2uxZ698Obd3Tuto8:AgXLk91ar1rKRn4lAQ+1hNUOr9HxuS8

  Score

  10^/10

  stealczgratdiscoveryratspywarestealer

  • Detect ZGRat V1

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2