Extracted

• • Target

    5dcca8cd88e96c87d548d21c582e6534

  • Size

    1.7MB

  • MD5

    5dcca8cd88e96c87d548d21c582e6534

  • SHA1

    0715d363f54b89afc0a2e3b685ffa45cf76fcbeb

  • SHA256

    2b0e5a007f1b13a5f5380718ba98c8e00c087315501667d03ebd6bf986205e2b

  • SHA512

    5d48b7f2182f440a0201cb4c83f283b3866f9745ff0d2b8b79e2dfbcf68742d0d42a93fdcae680e031c09cdcdf417c40607e62e519adc264383da4a4e74ef2a7

  • SSDEEP

    49152:MZO7NPP6UaRoNqZRTeSSwvA8kfLQ68fkCtgHREBfJXA:CcPP6UaRoNqDeSS6tEQ68fkCuHREBfK

  Score

  10^/10

  bitratzgratpersistencerattrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2