Extracted

• • Target

    3dab021a3f3de36764faea9bdf6a58a4_JaffaCakes118

  • Size

    412KB

  • MD5

    3dab021a3f3de36764faea9bdf6a58a4

  • SHA1

    db94f26d20b10730445deb16a1c2b521b4f15849

  • SHA256

    bd3b6502224d6aa64a38ec8854d9aa4d015c803b90bf5ccc2527f5d3021fbaf8

  • SHA512

    8ef5db5de0e100f06f45b34cd28b564b3cc792fd284fcd87f647b3c35683114751925359b65f5aec829dd65ed8c3e99ec889275c7d6e6f2d179c8b7c855af998

  • SSDEEP

    12288:yEHgAVG3oSEKyNJD4xEbMMEOn8c23H93:yEAlyVNJD8qR8c2X

  Score

  10^/10

  lokibotzgratagilenetcollectionpersistenceratspywarestealertrojan

  • Detect ZGRat V1

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2