Extracted

• • Target

    586f79d31e3b60f3737c247810e56612

  • Size

    1.8MB

  • MD5

    586f79d31e3b60f3737c247810e56612

  • SHA1

    ec148bed94d3a4e9dabe517533a74b6021d02fef

  • SHA256

    bf6b69cb7063d748e6404300ed8b587473b20b2239605862ccbec909bccf7485

  • SHA512

    0c72552226bebd0b71e789a875693fd157c3071e14ca5abebdb54e1d6cddb326be0db3a7c37957ab0b1a1cf090e3784c09e5085c1e322e16e9984c5e9af5142b

  • SSDEEP

    49152:V2GnkYpnt6j4Va7ep3sQDHDdtf4NN3cpbV:Vk0y4VoeN1DLfiKbV

  Score

  10^/10

  zgratpersistenceratbitrattrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2