Extracted

• • Target

    SecuriteInfo.com.Trojan.PackedNET.2588.29559.23114.exe

  • Size

    542KB

  • MD5

    40c1ba471569a321aa99ccd124f1454f

  • SHA1

    2a9c3cb89d12d2a549e3f8d6d2186462a8a92015

  • SHA256

    955d7e07ea9b12cd8b719bfbb7bcc463cec11103b7f3040d36ecf5e6c8ef04aa

  • SHA512

    d47229f04ed806228ad5dbf220b4c948f22f20fc435f4241ec96bc6b07ceba2a156c219aa168bae42175b6c89b1d2ea8f10cf2e7eee38b677679875d9f254a3c

  • SSDEEP

    12288:C3IU8S6eUdCUxnTauA5+Imp9npsijaTIXTx0zHh7L3gX6T/r:YItSAdDTFXp9nppd0zB7L3wY

  Score

  10^/10

  agentteslazgratcollectionkeyloggerratspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2