Extracted

• • Target

    invoice.exe

  • Size

    617KB

  • MD5

    bdedff7283522a464ce8b8f0462af80f

  • SHA1

    1a9aa24b394506f87c848f8bca2ac56946d03c54

  • SHA256

    5f098e8e5a3788ca13ef019ec9cc3e4b0cd83f01b96f7f7610c273ae6e6e97a7

  • SHA512

    c3a15670fb12624123e620271c4c7ea2834b76f31b72b63caaaa22cb333151c9dd043c7355254ece1d976317363aafe2b89e539abf17823b0c6b010336b1eeb9

  • SSDEEP

    12288:D3IU8S6eUd5x00ceDEkjA+wI97GctoG9pQ9yKyRHBD8JPMExtCQq:zItSAd5x00p7ERI/tZ/Q9yKQx8JPMGT

  Score

  10^/10

  agentteslazgratcollectionkeyloggerpersistenceratspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2