Extracted

• • Target

    56d46ffa8b32e27d0b2b11c75703ac70_NeikiAnalytics

  • Size

    382KB

  • MD5

    56d46ffa8b32e27d0b2b11c75703ac70

  • SHA1

    ec25bf6871882b57fa3d96e8c71c7386ac223cf4

  • SHA256

    0cb6c3f4dccf234573e435d852369ed1eafb10099aac83e3ca4f91cc6c9952b0

  • SHA512

    a4f7fef85fb79d51fa277138ec51d942a88c697d4557d2c333242b93a3fbcc2e6ac4d4ccc5ff585a7f70c5bc1559ee32dcbaecf380b62aeb8d71417f2d3ed2d8

  • SSDEEP

    6144:L0NTKE3CDWHhQgoFZHaJtrzQr792AiXQvdUodm7iKMceJK2l:L0NGMCaXoFdAFzQrJviXq3w7IJK2l

  Score

  10^/10

  stealczgratdiscoveryratspywarestealer

  • Detect ZGRat V1

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2