Extracted

• • Target

    432e0c7502686e9481f9ca6789ad7abd_JaffaCakes118

  • Size

    336KB

  • MD5

    432e0c7502686e9481f9ca6789ad7abd

  • SHA1

    e762906f2796322d856f0b38bbe2a189324e7329

  • SHA256

    41a4b1a20caa14c769accdc803196fcc6f70968ebe9f8acd867321f7cc46962e

  • SHA512

    f994dc800a0c45738b6b1e8fe3f4f547abd9229e43717420125c292434d2abb7829936de10ad4393842a26c01fb887971d08121394a3d0326fbe13646681fac8

  • SSDEEP

    6144:jEUCChbFhINvtvbO0yhNPh/UCkYxKLpdDKIqtlxq5q+9xpZu:jEEYfKZhNPJU9YORKlU5qO

  Score

  10^/10

  lokibotzgratcollectionratspywarestealertrojan

  • Detect ZGRat V1

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2