Extracted

• • Target

    SecuriteInfo.com.Win32.PWSX-gen.22941.9792.exe

  • Size

    614KB

  • MD5

    c76751eb111c227d587f5aff012df2fc

  • SHA1

    89069a18e42fc15da8d221893dbadef9715ce5c8

  • SHA256

    3f479de77fd65ff82d89c44b941aedd81d9afe93093699e40ba82b02e058719a

  • SHA512

    39b7642c99bace5f1a1577a58cdb702fb384dbabeff28e9044a373b4f1e4c8a05e672c52e4ac21d16503afec5ec2f6656506a73901d8233c620f3110be6d827e

  • SSDEEP

    12288:z3IU8S6eUdSTThn7IDPAbXopeOBA2TiE20XpMaqzIH+YOL:DItSAduhI0bXoVwEIamDH

  Score

  10^/10

  agentteslazgratkeyloggerpersistenceratspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2