Extracted

• • Target
    Агро-Альянс_(PO_460387320)_pdf.vbs
  • Size 508KB
  • SHA256 262001fa47c949d07b1998343285eff24a6c5603f5d60946bee05728412bfe5a
  • MD5 055c0925042cb8d785f50c598449a755
  • SHA1 b9a1ef638c9f8445ee5f8d9536a752e85f6264a5
  • SHA512 b04316d155e50aac59c0dd85e3e10445fab222fa3aaf95522a3f604c083b9a2d5311326714ed316a850889b7af3b9c250c55e9f9322d5f8eedb92107428243bd
  • SSDEEP 6144:joo0L2LxOF3NXwg6+IPhlyS8AW1KWTTVT/qaNKk4dcZvV++9VsK3VcVVYASzkIDL:jGtNXwd+IuvAW1Kub4detsngASzkIDXb
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  lokibotzgratcollectionratspywarestealertrojan

  • Detect ZGRat V1

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2