Extracted

• • Target
    Ezxotfkmz.exe
  • Size 451KB
  • SHA256 89d511c97a4e0f4bf48a72fe764adb6d3de9007859c7632dc07477f2062c2b20
  • MD5 0d34f2b095cbff0be00eb45758929907
  • SHA1 3fa3b5e296d49c4d8e6dfc5d4b775a48609aca78
  • SHA512 6965e9d2c2b9a11bb428ba8ac47202b7d0d4aaf826f905fb0afee903b2ae4b85cec446b536721b84237aeeb08f03ff413a67c75c36ba78d85a6727831e7b6340
  • SSDEEP 6144:xpHC550+1KYQ2JRpK3SRgadBU9RwfqUKDPi5xo/nY:xpis+S2JRpK3SRgKQ/n
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  bitratzgratpersistencerattrojan

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2