Extracted

• • Target

    Tdkdsxz.exe

  • Size

    4.0MB

  • MD5

    673dd7435b21ae0bd9a753e8a3479d93

  • SHA1

    939562bb513b604400bc53d7cd26915f8d378f46

  • SHA256

    fdecb6d9df9205cb6f46e80d6a0dceff4fb65ec54e1768afbe6ad8116c5621ab

  • SHA512

    a1d2f6e84c487438d0c3721a1815c786b62f33e6675205dfa32222c07a8fa80ab9537a8cba23ec21612f74005ff3ebb38d182761077fcc39f0700e98e132ee70

  • SSDEEP

    24576:SYwCOHRY4aytJk2us0L+VYVqSaZhusqBGkDCUn8De6ZCLIZ9MXgrfzVvjSnF0m1:4COxY4AMLVYuZhusqkkDCUn0XS

  Score

  10^/10

  zgratratbitratpersistencetrojan

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2