Extracted

• • Target

    JaffaCakes118_1fe5a90e2ae466a1592fbbe1f36eed42b5d50ab0d5090a2a601a1c52f9a38e7d

  • Size

    700.0MB

  • MD5

    5cbf88d9ac19d0f1e7bc1ad7f832fd4e

  • SHA1

    42e5c569044bcb1b2e0df56ed619de4857441953

  • SHA256

    1fe5a90e2ae466a1592fbbe1f36eed42b5d50ab0d5090a2a601a1c52f9a38e7d

  • SHA512

    9dbe161830305a3d0bc3228978e20575f4b1936add27670ab09d9194a89d8f75b8c01c8fd0dceaa8d8bf7a28a50143c2d68147dafdf9a64001b1bd2f7b719c90

  • SSDEEP

    98304:2aiY94OibC7uFOqRNAGmW0XPfd3g6+H+lIZAuLYO:2zgEOiNNmW0XPfdg66j5LYO

  Score

  10^/10

  raccoonzgrat1fa2b867e4d5e41181a2311356e86268discoveryratstealer

  • Detect ZGRat V2

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon

  • Raccoon family

    raccoon

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Zgrat family

    zgrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2