Extracted

• • Target

    Cvdnacb.exe

  • Size

    23KB

  • MD5

    50e198816a25e6ceeaf4174413b7d1b3

  • SHA1

    5509191f320424402266c02b9b6352aea32638f7

  • SHA256

    748d3b47d1498c7bbf2205b98e8ed577f95872d980ac06baee0426d1c8b166ed

  • SHA512

    c7149694fdbe892ebd8345970f848c0a54de294792b802dcd262c2e9370a4936dde56cd3184a0269377c9c9ee8c8bef62ae2526842ee1caf84696b64eb08f853

  • SSDEEP

    384:M86Fw68yQDd5DY/5i49Rtj1sgw2bCoTBPmrQSpb+5S/2vHvrPQ:4vkITztmgXdST0PrPQ

  Score

  10^/10

  bitratzgratpersistencerattrojan

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2