Extracted

• • Target

    Purchaselist_january2024.exe

  • Size

    673KB

  • MD5

    b61753a6ba84f4688875f9c07d039604

  • SHA1

    e22f5af6b9fbbd7c8a054959f15cd37de2eda8c0

  • SHA256

    d92da33493917017ff937789890dfacd02c22671abd9ea8c196ea9dfd90f3a72

  • SHA512

    7b916fa10ed2e4214f6853086b319d9408d7470fd4d1a119de171f7e31193383d76432b529c456227cc3f5e07aafb30db6ac89885c515462eeb7f86f5066b700

  • SSDEEP

    12288:e1G+4WpAEvy9i9cHpLoKY0otrztmzsw61l3sg1+YOoTOanF+:IpAE79Sop0ot9mQwmlT+YOoSa

  Score

  10^/10

  agentteslazgratkeyloggerpersistenceratspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2