Extracted

• • Target

    SecuriteInfo.com.Win32.PWSX-gen.19556.4239.exe

  • Size

    51.0MB

  • MD5

    523d4452385298579ba902834cf11541

  • SHA1

    e39e129b683cf47a9175500966515bebaac54943

  • SHA256

    12b80bb1663c85dca6a1a7893d3ce3e15b77841f85f75c6a8daf4c4ded24c684

  • SHA512

    a96457a632caf8ca2eb7a62888595f764e316fd2c6adaec0c95ed6eeb2e3a13353b8e5e43ea27d5deab61425e50b52aad76a8c52a360845d07ca6341e22a8b85

  • SSDEEP

    12288:DXVx+4WpAE+ycoCROfz8S2SGYMKxiS0cmHodkiZklxJ7uOD4j+Xfl+6L0+:EpAEGoCoL8SP/fxqlIatxJ78jOfl

  Score

  10^/10

  agentteslazgratkeyloggerratspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2