Extracted

• • Target

    e55bf27e175b5841bc948e58bc2c13ac_JaffaCakes118

  • Size

    373KB

  • MD5

    e55bf27e175b5841bc948e58bc2c13ac

  • SHA1

    731b6d9000072c4d489bc0e786cf463367047964

  • SHA256

    c49decb0015b632d6b624ebe0486c342ac7b3e05332b03509558cadb1c705c38

  • SHA512

    e91fd9cb1d2882ff566fb54e7645d637b5b993f3d16d1347aa1be69ff21f125031595ec9ff541ca498db65a86905c2506bdd28c0a5ae146bfea3afd51dcaabda

  • SSDEEP

    6144:+Gv81lyW3q7SnXirXHf6NC27NhmBbT0/KmwmP9/2F6q5UQSosWxPTv:GQW3q7SnYS427EdmwA9uF6q5U6Rbv

  Score

  10^/10

  xloaderzgratninsloaderpersistencerat

  • Detect ZGRat V1

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Xloader payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2