Extracted

• • Target

    51e9ae4378cb38ff331ad95f35cba605

  • Size

    660KB

  • MD5

    51e9ae4378cb38ff331ad95f35cba605

  • SHA1

    8b37a8eb9536972a6bada81d92c109f76ef4b292

  • SHA256

    e56c3eed11cf94d29ac1c24369887112b374e3053b371cafbbab9bc176e12b77

  • SHA512

    5da0a8dc125c2d2cd23ab737e0d9b7a1ee65b21629bbdc867f6890d3a93c20f0c03784184c31a4953a62fb2a4c4e7ff05a81901185db1e3848dc7d61aba845ba

  • SSDEEP

    12288:h8Rjc7UCAIf16KRBhc0ddzKwNkjOaOJ1zoKjquWO:ShNKf166c0dY9EyKOv

  Score

  10^/10

  blustealerzgratpersistenceratstealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2