Extracted

• • Target

    2becacc54640ee85368060f50cdf970c

  • Size

    1.7MB

  • MD5

    2becacc54640ee85368060f50cdf970c

  • SHA1

    fc5f72e653bcb507bbb0d8f95b14201930dc3eef

  • SHA256

    fffa9ead850e0fcaf571a59b808bf2b2d25b465be4d7300b3f828c63ac779259

  • SHA512

    29417107a44f9eef89d3ab35dd2ba52562f41651c04ebc2dd464a76b4a561fbf9aac5f8f35fb53b1f6d4ce8ea85cf66a038d530b6ca3e3368b8477a5da1f3c34

  • SSDEEP

    49152:R1cDVEQUeU0PlCzs3nTGgVduWYwaIjctIPVWLp2y:weeUEbTGgOWY8j+z

  Score

  10^/10

  bitratzgratpersistencerattrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Detect ZGRat V1

  • Modifies WinLogon for persistence

    persistence

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2