Extracted

• • Target

    UfiLx6GLjxILTU0.exe

  • Size

    673KB

  • MD5

    92ed52650cb2779f98ba8f77f5aed7e0

  • SHA1

    fbadf818e2097eccd5efb1cc2209ad67d78e7222

  • SHA256

    c387097faca12160800720ceff30ff0dd3a1b1185c3a212e83e95185bf8deb87

  • SHA512

    20072da30170a1b69720700572b51ec99d92e90fbb5abbc1272f3147c33f48864aa2af29af3f12e7ea0af75418ba19898be472fd37bec6bfb4ec7be823a76f3f

  • SSDEEP

    12288:BnBgOWP6iqpEmQepZ1f2wRRqKoYIDA/ZTAZU6z/0i6hsSZi8bnZOr4fWlr:ZCkpE7wrRoRDA/ZTAZU6zCqmns4el

  Score

  10^/10

  agentteslazgratkeyloggerpersistenceratspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2