Extracted

• • Target

    e712e8ee3d9d3bdf34029516d2755ca5_JaffaCakes118

  • Size

    565KB

  • MD5

    e712e8ee3d9d3bdf34029516d2755ca5

  • SHA1

    5c8ad1cc914a225f386a6e8a3bdcb012580c33e2

  • SHA256

    69fb813254cb7d90156e5787b232f46ee4229d64dc1353488a7991ba830c223a

  • SHA512

    39b5c1b8d4a6e01a8588ae520683df143bc5e68b4f1bfd623accfaf67cf6c52e1663c5f0b3f3d55ee4bb144c8e0e570593eb17b04b288df23138da5305e7f932

  • SSDEEP

    12288:JF8Oep7o2b8ikshSkz6ppCFXIw5Iofs5OJYRMkuVv3z5N9g3WeJt8DELiPD:JF8jUSXZsrYnx

  Score

  10^/10

  snakekeyloggerzgratkeyloggerratstealer

  • Detect ZGRat V1

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2