Extracted

• • Target

    233c0db3afe81ec0b12859e9ed2ad96e

  • Size

    2.0MB

  • MD5

    233c0db3afe81ec0b12859e9ed2ad96e

  • SHA1

    b6186ca1301c5b05910013a62d08d01751c74e3e

  • SHA256

    6c0b8d19ccb66f0fbe99c4882d620a3bc5c95a78e67a8fc7f69918c404bfd4a0

  • SHA512

    7ae6a481002fb5036a9415a5d45c5f506787e712a61783ce25d991c11b831fbdd14d17eca92b29a2c6466d31928ada8959ff426bf2b601955f986f9fccf6585a

  • SSDEEP

    49152:RHRk1X5GhWaMRWWxVAe25ZoyJk3d4iGm44ut:dmGbh7uyJkiivI

  Score

  10^/10

  bitratzgratpersistencerattrojan

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2