Extracted

• • Target

    DHL STATEMENT OF ACCOUNT - 13010913667.exe

  • Size

    648KB

  • MD5

    c48c731dd49eb76bde86a705f26609e5

  • SHA1

    561802b63360b0193709b534a6eae9a9f2f32225

  • SHA256

    0368245b094c8052f505d99d1ced140ba11a1146febb512934b4bbd2a6820b4e

  • SHA512

    d8202d3b2af3424e133e465c0145331423dc6a377a9183c29ef399361553a9bb65cc8268177eb8c5bbd398df09b6518ff8de4e866b7977acec89445df5cf9406

  • SSDEEP

    12288:9W3IU8S6eUde9k6VjDvLP7GebMzEivFlYhOVyjHnuVv6:9sItSAdeHpDDP7xSE4mxjHu

  Score

  10^/10

  agentteslazgratkeyloggerratspywarestealertrojanpersistence

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2