Extracted

• • Target
    SecuriteInfo.com.Trojan.PackedNET.2588.29559.23114.exe
  • Size 542KB
  • SHA256 955d7e07ea9b12cd8b719bfbb7bcc463cec11103b7f3040d36ecf5e6c8ef04aa
  • MD5 40c1ba471569a321aa99ccd124f1454f
  • SHA1 2a9c3cb89d12d2a549e3f8d6d2186462a8a92015
  • SHA512 d47229f04ed806228ad5dbf220b4c948f22f20fc435f4241ec96bc6b07ceba2a156c219aa168bae42175b6c89b1d2ea8f10cf2e7eee38b677679875d9f254a3c
  • SSDEEP 12288:C3IU8S6eUdCUxnTauA5+Imp9npsijaTIXTx0zHh7L3gX6T/r:YItSAdDTFXp9nppd0zB7L3wY
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslazgratcollectionkeyloggerratspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2