Extracted

Extracted

• • Target

    2vka.exe

  • Size

    647KB

  • MD5

    2fdc906a1378fb1b0fa02af9b1a34c47

  • SHA1

    9478eef6a6238e11248b4c7a1c0fb3943dc93600

  • SHA256

    97684fe0c1e526bbc522a12c9f56857a7702ec4d1dc0d1d27b9914fbd12122b8

  • SHA512

    38ab61ec176fd74f2e4a0403acdc1a2bae79721054a0f962a21665da0f2b42a503dd4b6864b1e3e7cf5f6a45abf15a9ef7de69cc0ab73bb3a35e66e87f73b35e

  • SSDEEP

    12288:9a3IU8S6eUdLj9oPGt//fU7RZ32wzEdpYvYZuOcprN6A730zbPbBi3e:9wItSAdLyGl/S12wzO2AZuBEA7kXP

  Score

  10^/10

  agentteslazgratkeyloggerratspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2