Extracted

• • Target

    09b8bf9309936096907f5b509efbae7114ea6d7c33197b98000ce8c6abd5f7b5

  • Size

    562KB

  • MD5

    f304d7b3be5b545fa344af558999a35d

  • SHA1

    89fbc87364300507d70737b0a8f69fd7b3709ac0

  • SHA256

    09b8bf9309936096907f5b509efbae7114ea6d7c33197b98000ce8c6abd5f7b5

  • SHA512

    4a855d466c2860f73394a6aae9f23fa11b9b0d14e4cc5eeff28763c808f421a4b46d1b54b05d61b949fc05d0e9f1151b9a85f101821827fe50c76330ead91e70

  • SSDEEP

    12288:KBgOWP6ilo7OnSmzCSYWLhn2JoGGPTtn9YVkKWIls1DtOdBg:KCggSHyN4ZmB953IK5tX

  Score

  10^/10

  agentteslazgratcollectionkeyloggerratspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2