Extracted

• • Target

    Ezxotfkmz.exe

  • Size

    451KB

  • MD5

    0d34f2b095cbff0be00eb45758929907

  • SHA1

    3fa3b5e296d49c4d8e6dfc5d4b775a48609aca78

  • SHA256

    89d511c97a4e0f4bf48a72fe764adb6d3de9007859c7632dc07477f2062c2b20

  • SHA512

    6965e9d2c2b9a11bb428ba8ac47202b7d0d4aaf826f905fb0afee903b2ae4b85cec446b536721b84237aeeb08f03ff413a67c75c36ba78d85a6727831e7b6340

  • SSDEEP

    6144:xpHC550+1KYQ2JRpK3SRgadBU9RwfqUKDPi5xo/nY:xpis+S2JRpK3SRgKQ/n

  Score

  10^/10

  discoveryzgratratbitratpersistencetrojan

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3behavioral4