Extracted

• • Target

    SecuriteInfo.com.Win32.PWSX-gen.20943.19478.exe

  • Size

    541KB

  • MD5

    42e3f6af3958538a12e6cb658f81f7bb

  • SHA1

    5bfebb36c4c0e312fa2231825a564f61ce4b756c

  • SHA256

    1285b4c3035e7e99784fa960522765ef492b5425bc9c02d002f1d076692992de

  • SHA512

    a50301b45d03d1b9b3b3836a196ece2ff15f2e98a71756d252dd135e95ea5b823e5e5207a7a4e9bc80e020dc9fa378695528817cb97e792f2e7bf1c396317431

  • SSDEEP

    12288:G3IU8S6eUdSV/9gUzpjXJdZ03XNF5cXRS0nvYLltWyy0H7BTvCyIwB:8ItSAdSDpjX/ZiwdaZ7BTdIw

  Score

  10^/10

  agentteslazgratcollectionkeyloggerratspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2