Extracted

• • Target

    payment receipt.exe

  • Size

    918KB

  • MD5

    0267124a0f286b43897b99dea1f3b0ea

  • SHA1

    dcc8590b8fc2adfecb01c919f80f4a0d30c123b4

  • SHA256

    4a5c1ecaabfa1e8421a4a975593f1563f5170f538daa982ea2050e902bd7dd28

  • SHA512

    72f5908456d73f3a180db5c2dc869043130b7af35be918131fa72ada0b969c9d3cbf90754d0700bb1864ba0714f1d3e800272bb8f0d6e5d52192a7e33a2b23aa

  • SSDEEP

    12288:R3IU8S6eUddsV08lxM1lXjfZBU+wfiFWXO68KVJtG90oGw+48MbcmXS:JItSAdWU2ZfiUT8WS0oGb48SPi

  Score

  10^/10

  zgratratagentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2