Extracted

• • Target

    ff887fa7815b8759a4908e7db7246dff_JaffaCakes118

  • Size

    2.9MB

  • MD5

    ff887fa7815b8759a4908e7db7246dff

  • SHA1

    643240f371ba273be5d24d279fa4a12e45d49b19

  • SHA256

    34637d766580ee138044aba566756d6ee1356ad1915df4778c72e74dcabd25bb

  • SHA512

    3b409a1afd836636a25b93e9a6a8c15d3686b249a05ba60735864cf884f5f9a816e96ee02f411bc31cba5380f1b5e861f5b78c09ceb9c9eddd2a17fe90cf614f

  • SSDEEP

    49152:SaMq0SaVfvc8NDRxHjfUlcfkDKG0y4fTOy6XWa:RWa

  Score

  10^/10

  zgratpersistenceratbitrattrojan

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Detect ZGRat V1

  • Modifies WinLogon for persistence

    persistence

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2