Extracted

• • Target

    4372c18fbe734ef31fffe8fbde52adda_JaffaCakes118

  • Size

    355KB

  • MD5

    4372c18fbe734ef31fffe8fbde52adda

  • SHA1

    4b65e3ea741ba115088ffd0915e7f1963c4d91bc

  • SHA256

    f5fa18d39f0b842d6a142a8c6da920bc494e880b5909b196fa68e7e6ffe4604c

  • SHA512

    f906dfc4ae493b57c974770b1f2dc9d00a1c8a69e1e1eb625ef5eecc67fb385b1b68d4d0547d2aa6a195b4a6a4348a3919338d41511e9f83e9b243fd14e182d9

  • SSDEEP

    6144:l9m82gw6NuqWzgETzScJHGfX80mzZPN/Wbt/jOXTTwhA4rdr:XKSuqWqcJmf8FxhWFjOXvkr

  Score

  10^/10

  formbookzgratpoagilenetratspywarestealertrojan

  • Detect ZGRat V1

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Formbook payload

    rat

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Suspicious use of SetThreadContext

  behavioral1behavioral2