Extracted

Extracted

• • Target

    6c510957c26db484e750d3834eb7a071.exe

  • Size

    470KB

  • MD5

    6c510957c26db484e750d3834eb7a071

  • SHA1

    8addfedd831f65e85bd9bb7bc27f04a69d45dcf2

  • SHA256

    200a8761ad54a3eeb3039a37d654f3be76efcdd5a51b1f6f9f4b9584dc998e1e

  • SHA512

    29ed05ad27bba9286ae421ca2eea0634648f23e045641875be5574bd5dd2e31ffbdb07a61e61c0b2f37163994572bc04c29ddb65ea5881acd22d3761c5ecd6d9

  • SSDEEP

    12288:wPqSSSrsBhphNyXk8ejoPo0sBwT/BIxdSG1rfUPeAXa6:+UBhphNN816U+jU2AK6

  Score

  10^/10

  agentteslazgratcollectionkeyloggerratspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2