Extracted

• • Target

    PO-0075930-1.xls

  • Size

    1.1MB

  • MD5

    c677f23b98f41ace3e30b3451a29e865

  • SHA1

    c04789e8a9edea9ad9b8694bbc471460ce3d2e8f

  • SHA256

    46cc5500d9579887c1d2694b124d18f2915c0e372bd725aa57a4eb610e02a75a

  • SHA512

    fc2bb50269d62a5d31b82dbbbfbdef9164bbdd14f4406e82ba3238e338a9c306ca1aede8c8e81e0bfb23bd861c2a965ce1e926712d9919bb7f09d36ce0a223b1

  • SSDEEP

    24576:Bw6/4ZyEAXZS8sw6/mZyGAXZSZiGwwcqZUovtJfTJqdLQ33powDXH:66/qKEE6/wEE+CjvjdMLQ33pokX

  Score

  10^/10

  agentteslazgratkeyloggerratspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2