Deobfuscating a Dropper for a ZLoader Trojan Variant

On March 18, 2021 DNSWatch analysts analyzed a heavily obfuscated Visual Basic Script attachment (Attachment_57904.vbs) delivered via email; the script decodes many arrays to reconstruct a ZIP (assai.zip) that contains numerous small files and Rabin.dmg — which is actually a 32-bit DLL and a variant of the ZLoader (Ursnif/Gozi) banking/infostealer. The report documents the deobfuscation process, provides file hashes and external analysis links, shows screenshots of the code and extraction steps, and recommends mitigations such as email filtering, endpoint signatures, user training, and patching.