Extracted

• • Target

    1f112904748a1369e6fe50dee8b00756_JaffaCakes118

  • Size

    595KB

  • MD5

    1f112904748a1369e6fe50dee8b00756

  • SHA1

    00c42823f74ddf87db776d746eee3e5fd4f33b5e

  • SHA256

    d5c67af1346fed0b4ef7106cdca4ed27c8a574bd0b4e01258d56eec76a8e2968

  • SHA512

    5615882042bbd73bb85d763d23533027e9898d2b4c44965ec20f81f3f8404179701f283747887bccdcea0ee6165e98765159a7bbe779d6a283acc90a8c3bfc5c

  • SSDEEP

    6144:u71StmT+sbAyX58ZPCVuif1StmT+sbAyX58ZPCVuiK4itpOc0FDBK1OKPiOM8zI9:C8yIy581Qv8yIy581Q64MZKwOK6v5k

  Score

  10^/10

  formbookzgratyoagilenetratspywarestealertrojan

  • Detect ZGRat V1

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Formbook payload

    rat

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Suspicious use of SetThreadContext

  behavioral1behavioral2