Extracted

• • Target

    SecuriteInfo.com.Trojan.DownLoaderNET.887.32058.19470.exe

  • Size

    12KB

  • MD5

    5e3527011ebaba56e95c7062ca256b40

  • SHA1

    970fc074b5e86939711a2c6662ef21b8746cf3c6

  • SHA256

    3e0693763c73e9bfa7f66c47625abc09b3ea401219602809a7ec9c258731cbf5

  • SHA512

    b1a4e63db7d3e48fcbfaf75369893acd62666d09e16748c39b3b8da200a1d517d11815bcf75948c5c2d0553cfaf39d779a63e5f3527f8453af1f08721141023b

  • SSDEEP

    192:FTXGpqwm2fWKm7ALBBhaqFYw55bGTzK5jX92PKj4:Boqwm2Zm7SxFv5JQzKJX91

  Score

  10^/10

  agentteslazgratkeyloggerpersistenceratspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2