Extracted

• • Target

    41965fc5d071ce4b42bba9b7c486f784

  • Size

    4.9MB

  • MD5

    41965fc5d071ce4b42bba9b7c486f784

  • SHA1

    e1c90feba42abe5c4ae88d86ae75e021f55afb0b

  • SHA256

    e386c831df697e516fedcab1ad8a879ae057a5f4f321a873dcd31e9c6760009e

  • SHA512

    7ccc5337e0ef03eec69d950af1bf698a53f324e176a8fd05cfb4dc978774663de60637f10f00db4976596867612889d335a7b2b4ffa0a3caf68354c34d4515d9

  • SSDEEP

    49152:36PaeNTtXgpSTeCrkJ9rV/FZjRrZHFqtgJIHiSynJpwjIcOJFSNTUyzL41:kagT+4TaWTUF

  Score

  10^/10

  bitratzgratrattrojan

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2