Extracted

• • Target

    7a8816516d1fd8a5ed5d776e19f55c2c

  • Size

    638KB

  • MD5

    7a8816516d1fd8a5ed5d776e19f55c2c

  • SHA1

    bf2766fc7f539378e6fb0f76375fcb601015dd58

  • SHA256

    a8582fec38f091e2c010b935f44d17b0357a4df55ca4b03c0c25b75640e1997c

  • SHA512

    d15365f42d63f5520ad58510b453d8ad07b1648bd34e89aabe210a047722a19c4b96ce6e563a34479cfcf21f3e4b358283a745e72e370ae2c452838610bafa96

  • SSDEEP

    12288:k3WjEfEioef1MQxBzi05hrsRApwRBTg0VArtwR/7gzK5:SuJUf1M2i05BwRBfVRzgW5

  Score

  10^/10

  zgratratblustealerstealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2