Extracted

• • Target

    6d1109143a780d9b34416464d04d39ee

  • Size

    2.1MB

  • MD5

    6d1109143a780d9b34416464d04d39ee

  • SHA1

    73d85a46cbf3aff762f1535bc025e9345853f1cd

  • SHA256

    3b428e625277adb1803ea3523c600a63156ae7eb144637e68f7377e92b6d4c68

  • SHA512

    24810007a0694c8d3c55766583a82ee9b98409343f92fda686110ca391cd4e4e5a3d31e56ccd7daa2dc8b6ae528c8dfd4c840555efe62b962fb815963b5e9dc7

  • SSDEEP

    49152:fOTCfjMgXEEIw+1PZnLJ6Q/J4yF9hmOtGNK2N64bEL:fOWftKh1BnLJV/+yF94WGFVbEL

  Score

  10^/10

  bitratzgratpersistencerattrojan

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2