Extracted

• • Target

    6638ddecbc7828d02bf54e1526931350_NeikiAnalytics

  • Size

    365KB

  • MD5

    6638ddecbc7828d02bf54e1526931350

  • SHA1

    1fe3bf603e4f7c32936a5d5aa0f515719aaf8782

  • SHA256

    f7647c3d4fb2b8f1973aa3f997b9b8caff993f74d7d96510df10675c9c3bdeb3

  • SHA512

    dd8edb894df0994e10d80a45e41e8eeebb80f75dfc27bdb8a58c82d5a2e82c300f0649c028b4a142aecf19ecad7862ce7cfbdf2a06fadd2d82d5313c7ab6a0e9

  • SSDEEP

    6144:0j9PNW6k+7KXF5gUZwnAFpPLr2PXEVT1NjGzG4YqJcbbYTOO6:0j9PA6d7K4UZwQ2Xw1mt+b8OO6

  Score

  10^/10

  stealczgratdiscoveryratspywarestealer

  • Detect ZGRat V1

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2