Extracted

Extracted

• • Target

    SecuriteInfo.com.Trojan.DownLoaderNET.887.9426.29852.exe

  • Size

    17KB

  • MD5

    af317f313efdbcfd959ebd12cdca7ef4

  • SHA1

    d30eb416498ab3adb33351fb8aadbf84af0b53f4

  • SHA256

    bd8edeada1927c7fc6c0a816c824f5973477368cc61045c7d8ab4f1d60c842a2

  • SHA512

    bd6e82d6033bda321cfda5c32729dea111274349266a6a679d629b597711cb5dc5c078095259ecc3c7226878d4e88019434ac11ffbddbda9cad018b54fdb45d4

  • SSDEEP

    384:p7n2/uF8iEgE6ki29QAV1VF0hXHMGBk7/UMQ3J4:NnFHJP2/V1VaXLkj24

  Score

  10^/10

  agentteslazgratkeyloggerpersistenceratspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2