Extracted

• • Target

    45c772f399be8eb70956b0ae69224b08_JaffaCakes118

  • Size

    1.1MB

  • MD5

    45c772f399be8eb70956b0ae69224b08

  • SHA1

    cc5f32dd90c396ae857e4f75681f8e62cc4e0d75

  • SHA256

    0e658e76cd787fc1e7e65cbefd6a9e191b437ac23c749c90f30f3a3c307d2dd8

  • SHA512

    4c485c62e30445c96c47a729a840faad67eb03445cbec9295d01d605d8b8b3e2080d105630200bd5805c5822c281f2ebe551f822dab0407118b95263f64ad9f9

  • SSDEEP

    24576:hwhQbXOZ/2CcxqimT4GroidE4tAUHGRHnT8XDCbDRcjSEHDQLFZ/S:OQbiKqimT4iJWpNT8zCBcjSEHDQj

  Score

  10^/10

  snakekeyloggerzgratkeyloggerpersistenceratstealer

  • Detect ZGRat V1

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2