Extracted

Extracted

• • Target

    MT PAPA-AGENCY APPOINTMENT AND PDA QUERY_pdf.exe

  • Size

    614KB

  • MD5

    a61cf9dba3b76813d7a86479f17bbd05

  • SHA1

    51558e365127703dae72ae820bdc96defe5b066f

  • SHA256

    1d79756d1b41dd8556576d53dcce29b47791ad27316c62cc0e256d75dde3e52c

  • SHA512

    de6e95baf8466076999470c82ac1b9f382b05d3f2b60f5e089897d6cfe3975a836ead3ebcf321d1df625410aca32474eae12c6793a0fc7adafd048333bcfd019

  • SSDEEP

    12288:Y3IU8S6eUdEZ9cMK+rjvtIXx8ypIjpwi8pK3SVaXbRPg86kJWeVE5+ogDRY2dXjj:2ItSAd28+kx3yIpHibhg8YLzydXjQa

  Score

  10^/10

  agentteslazgratkeyloggerratspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2