Extracted

• • Target

    Purchase Order.exe

  • Size

    646KB

  • MD5

    fd4f5db156867b51baf72ce10cb1a486

  • SHA1

    d1c1ce8f0bf2bb7445610333ded67c4759209289

  • SHA256

    1ff764ec5a79ed2072a558af6de49b863e9e5683e63b3c070e86c9d1b7814f4d

  • SHA512

    f013a7c900d5f11fe041d88423c07efcbf31fcdc400da00db8be661ddedd5f7913083c3faf5ee6d49ab97741389a21e82c2050870677afc3383b7d5436bc92cb

  • SSDEEP

    12288:aH3IU8S6eUdsifKXhLvlg8J3PE1Nfjhm6MqOdWK3TLiMl:aXItSAdsiohRgWYHmaOMK33Bl

  Score

  10^/10

  agentteslazgratkeyloggerratspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2