Extracted

Extracted

• • Target

    Statement of Account.exe

  • Size

    665KB

  • MD5

    8cde3c38aba1d12314914ef9f392f249

  • SHA1

    41bf1c60d192446b192bf8de0906af8e4e35c38f

  • SHA256

    662d11eea0dab34f36fa8f01e49c9ddea9d111e71d0509fa25993525e486d837

  • SHA512

    7e2f1256a404438566da00fbecb33ce6e186a363b8043d7f9a9f7cda39cc2e2afcc05b35d25ac10c6415c576824e5c6ab7ca4132dcb282eca7b87721cf3eccf7

  • SSDEEP

    12288:QjHbc+4WpAEAy7sE3vSQq32CqHUjEWl4kFx2T9DcLEOyylTQK+p3c+z+:6pAEoAtqmCYkFx25aFuK+G+

  Score

  10^/10

  agentteslazgratkeyloggerpersistenceratspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2