Extracted

• • Target

    2e10d027cf069d30831476ed6dd76106_JaffaCakes118

  • Size

    256KB

  • MD5

    2e10d027cf069d30831476ed6dd76106

  • SHA1

    77ba4987d1dd520cc231eb822e056dc8406c402b

  • SHA256

    55607c427c329612e4a3407fca35483b949fc3647f60d083389996d533a77bc7

  • SHA512

    967e1bf06603df7d7000089f9437a629dcd170890c071b27687a199c56e58c632d384c6f764e5970c8011dee080d8474e600be5e40e3de3e8d65d4bbccf1bfdf

  • SSDEEP

    6144:4ovtAMGoVoQs82YxKvc2WTYM34DGb0sOcZcfnfrskVRA6l:4mt7GvQoYxoGb0sbZcfwQO6

  Score

  10^/10

  lokibotzgratagilenetcollectionratspywarestealertrojan

  • Detect ZGRat V1

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2