Extracted

• • Target

    5dbd6684e5601b2f8e748e02fa898558

  • Size

    892KB

  • MD5

    5dbd6684e5601b2f8e748e02fa898558

  • SHA1

    9a83397decf87975576dbb4fced3d9b611846c39

  • SHA256

    3d92d6a34be40684493e0cee2f5c772ec4a1f731cf8b371cad1eb9c492d9f63d

  • SHA512

    79cdc806624ff9ad1e2f5e20280880db099055380d0d27a4560d846288280b4d076c3f2e0b4742e665454db3df1f2f9f9d84abacad8c17fea99dc7e1772e27d9

  • SSDEEP

    12288:1FYf861bQyPlY7a3q6GQShv8me5CZMg/ln1/7x8a0Ti+l:1i06xQta3qxapkFLo2

  Score

  10^/10

  blustealerzgratpersistenceratstealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2