Extracted

• • Target

    f921112a3539f7f93529c88376508582_JaffaCakes118

  • Size

    2.5MB

  • MD5

    f921112a3539f7f93529c88376508582

  • SHA1

    957a4e0b947482a8215a9450f1890dd47e45e642

  • SHA256

    1e62a15bef6c5fbd94137a339272e93ee6b646f1f18a68a5e52d6e19dea03420

  • SHA512

    f229f48a668c08d90f296ed70f16c8c60a78fc243fe2040a9ddab1331e633b6c278b6e25723e03eccdca499e5cf7ea66915542ce3cbb0fd155590570796d4736

  • SSDEEP

    49152:9KscKOXDAEzXdG+591Zg+zQQwLb/KTmLmXAGw+4akSI6232QguwV4:MFDjzXd55q+sHLbdwA+4akt6A2QguE

  Score

  10^/10

  zgratpersistenceratbitrattrojan

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2