Extracted

• • Target

    1a110e8b971a75943f419d57a3dadb10_NeikiAnalytics

  • Size

    384KB

  • MD5

    1a110e8b971a75943f419d57a3dadb10

  • SHA1

    8f1bef0d49802b01c99bd79a3c4bf45cac4070c2

  • SHA256

    5c49c56c9e581f0b79d074e6560e42962d63ed40310547a5e4d36949b62cd641

  • SHA512

    3b03875fac78ccf03bf6fe7f3042ebae096c46b9e38a66a5a52fa2cddef3ab0b23bc932a023caa64850c87cf7cec04c8a6dcf5ef831304edb0bc12465e1f34f3

  • SSDEEP

    6144:CvNcF7Kk1SAa5i2mfLPrzOMWRTco+7ASGdHhyUZwS1:CvNo+nAa5gnXo+c8aT1

  Score

  10^/10

  stealczgratdiscoveryratspywarestealer

  • Detect ZGRat V1

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2