Extracted

• • Target

    e338018f8b5148cb372eacd88b539ab3_JaffaCakes118

  • Size

    434KB

  • MD5

    e338018f8b5148cb372eacd88b539ab3

  • SHA1

    973bfa4d59d3026dda6b27b17088f37b0885e172

  • SHA256

    b27e8818e65920ef719e41a01f7bc25145945662e0f01fb0f36dfe1195faafc8

  • SHA512

    e671a086b009ac2c703462f2ce6eb83cc29e2cb82e814e567a7093eb3386fce8e82bb36d6ffe7c89cb35619bac128ac46fede7f630e3652e216cf5ed64c4c4c0

  • SSDEEP

    6144:VsfKtJxyUfZJbL5ZQFk27HX8j6HKFqCjfv2xcniFT6uy0xvCo3RoRnQ5u:VsitJxyUBJhZQFk27Hsj/qrxaiYo3n

  Score

  10^/10

  snakekeyloggerzgratkeyloggerpersistenceratstealer

  • Detect ZGRat V1

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2