Extracted

• • Target

    fd84eb337a51966294ba08722170bf46_JaffaCakes118

  • Size

    1014KB

  • MD5

    fd84eb337a51966294ba08722170bf46

  • SHA1

    1f529d60e2dc50deaac59af322708039da33c3be

  • SHA256

    8da806444010084307c77bf3a69f66ca36c15920bd7b9f60fdcf35fccd460701

  • SHA512

    a522ba8c6daddbf69f711ef859c7e8fb79e2ab00372e6626af9119d82ef8cf22b0e2ebcc1897cd88810be5ee01b11e0950dbf0853ceb630de3e916ac3bacd847

  • SSDEEP

    12288:rFhlsU1cTDO+emag5IFyPK7yMmeP1vwdyAook1GZEUFA1Vk82C867LiuNyxv2AdU:rFhlXcOyeL3JStX+PbLk2QHQ

  Score

  10^/10

  xloaderzgratp6f2loaderrat

  • Detect ZGRat V1

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Xloader payload

    rat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2