This archive contains two files, one a benign document and one an executable. The operator tries to fool the victim by naming the executable with an apparent document or image file name by incorporating the “double extension” trick.. This new campaign, depicted as Case 3 in Figure 1, uses a more involved procedure. One of the early checks made by the malware is for the existence of a specific path used to drop every file used during its execution. It starts the executable — audev.exe and checks in the list of processes to see if one of them contains the string audev. Delphi mail downloader . The main role of this downloader is to assess the importance of the compromised system and, if it is deemed important enough, to download and execute Zebrocy’s last downloader. Emails and passwords are used by the operator to send commands to the malware and also to retrieve information harvested from the victim’s computer. Capabilities . While there are some conditions and order in the execution flow to collect information about the victim, the following section describes different gathering capabilities. For each file found on the disk, it retrieves the full path and the last modified date of the file. The Subject: of the mail is the id of the victim and the file is sent as an attachment with a keyword corresponding to the file content. For example, for a scan command, the operator receives a file that contains the list of files matching the scan extensions along with each matching file