Extracted

• • Target

    6fe6ba1439d88cf7fd8debb37324ce82

  • Size

    700KB

  • MD5

    6fe6ba1439d88cf7fd8debb37324ce82

  • SHA1

    6dd21af92d79085a4140be5db5c6faa7c5de2f81

  • SHA256

    42fe72df91aa852b257cc3227329eb5bf4fce5dabff34cd0093f1298e3b5454e

  • SHA512

    748a231fe1827a4196c27419fa9da80aefd0c7f77259125c567683ea9e4481d4f4e26dbf2946f7fa73572ce8b9548e96ea60a3772f9d39953953bc6b4ee8da45

  • SSDEEP

    12288:X7A4e3AWh7HmCo3PtAlMvc+ml5hy8MLlMUa5eYgeTgzXkYkbfytNE13+MMJnIXNN:X7sT7GV3ktv5y/zXkYgF+M603

  Score

  10^/10

  blustealerzgratpersistenceratstealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2