Extracted

• • Target

    193d1bb9c609ef883a556d3c8c3e789b_JaffaCakes118

  • Size

    503KB

  • MD5

    193d1bb9c609ef883a556d3c8c3e789b

  • SHA1

    a6aa05f46170ab543f9122f043cf3b28fccb871c

  • SHA256

    3a6d5150486d015dfa8916607c7f2f0bdd0ddd97fe4b11f15afecc40eab87a5f

  • SHA512

    44631124a67e948f1ed0d71250837aaaedc7f571e3c607e2536aa0ac66700e416c43be97bd2124a3c613d955925c182027f051d6785ee44510e9c6af74862507

  • SSDEEP

    6144:51StmT+sbAyX58ZPCVuif1StmT+sbAyX58ZPCVuiu+mKCJ90D+Y7a0h66549:58yIy581Qv8yIy581QS/w49

  Score

  10^/10

  netwirezgratagilenetbotnetpersistenceratstealer

  • Detect ZGRat V1

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2