Extracted

• • Target

    814f22a67e6d2046f532f973f197c649

  • Size

    2.5MB

  • MD5

    814f22a67e6d2046f532f973f197c649

  • SHA1

    049bdddb3349ecf80c079a38297ee442190a38ad

  • SHA256

    c2e1450509092251b7376c9d4acd0636b41c19060591c0ef6c3bb58ab7e49ee0

  • SHA512

    696315f90cefdec65e8c2a4ca2d8f9b79fc4dce5f0bf186dd50bca398c5e9f9ea435232de639a3847460ce4331d85535a433ce7c07518977b2931ffcee6f326b

  • SSDEEP

    49152:R6XZx5c96civqfPao3Hwa1VDhkYKt457bjG48GrbcE+SER:R6pxepiuR3Kt4Ra4N+1

  Score

  10^/10

  zgratpersistenceratbitrattrojan

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2