Extracted

Extracted

• • Target

    doc4567898762345678678889_pdf.exe

  • Size

    714KB

  • MD5

    c3d53387aaa39ee5e0897965033a65d6

  • SHA1

    30e662033ffc767276cf977070a82147ef38b44b

  • SHA256

    9e19816e28ea81520a46e89d85f46e573f4feed5eb0eef8537c36b1120bed32f

  • SHA512

    8418bb95fcddd6dbee91aa0b1af3ca4a64b7f928d0f08428f17d5235167b98e83274a6a13b44ce79eccf7383dccb50023d9df517d7294e05e1402ec84c6aac80

  • SSDEEP

    12288:mzEP/SJaF/J9x11ht3++d4z7pyjaUV2iA+OPjZTBobiHE8ZWZ:F/4qzvx+ZyaM29sbiHkZ

  Score

  10^/10

  agentteslazgratcollectionkeyloggerratspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2