Extracted

• • Target

    5f71c275b208fed60abf07949c9ee1c3b937736d2108bd22a0bc573f9eeb0cb6

  • Size

    386KB

  • MD5

    9483e9e0e34fa56d3ee1f4ab1d79f0d7

  • SHA1

    c192ad0730e31827ce449fa7bca9e4a4bc025242

  • SHA256

    5f71c275b208fed60abf07949c9ee1c3b937736d2108bd22a0bc573f9eeb0cb6

  • SHA512

    a883179f2d620e9f41633fc6f9938667cadcce8bc8542146feff7b8152144a95618b82f3eb134143ce233de7c05379f49744d188c8b5f8c6b9c7610e4dd94bca

  • SSDEEP

    6144:TcykrZfMtgEBXGx0Xy5gul0n4Qgf3ONjMMejZxxXx+0jTw3J:TcyktfW/tXZbgf3ONj7elxJw3J

  Score

  10^/10

  stealczgratdiscoveryratspywarestealer

  • Detect ZGRat V1

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2