Extracted

• • Target

    e4855192334bc3427b7634abcbdc4659_JaffaCakes118

  • Size

    818KB

  • MD5

    e4855192334bc3427b7634abcbdc4659

  • SHA1

    6c47e470fc2ea6844e3bb16700c14c86133d5779

  • SHA256

    17680c1b0efe77b4939fc8103d8c1b3a0245a99ed8c96fcd3903794179d23ee9

  • SHA512

    16ed44c3b4ca11bc896bb839f7a7f293edc42aa2d86b6ed7c12f99eb7ced3816076db1d6930e2da1a38766913bea177d5670ad6894af655b8824915d29d79ae1

  • SSDEEP

    12288:1n4JT4xi7lQBwpdOBbLeKTmrn+xr4onY4VTIAThKdxSqvcgAJ5Zrnvr91yyfFNT2:14SDF1fjePcDLv1S

  Score

  10^/10

  matiexzgratkeyloggerratstealercollectionspyware

  • Detect ZGRat V1

  • Matiex

    Matiex is a keylogger and infostealer first seen in July 2020.

    stealerkeyloggermatiex

  • Matiex Main payload

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2