Extracted

• • Target

    Zaplata,jpeg.exe

  • Size

    645KB

  • MD5

    df5f655433b8f20a6ba72aabd3738a15

  • SHA1

    7375302c7359d09cb7cff0923da0640adf5b4b63

  • SHA256

    d574783b27fe3548f26fdcf15380559464604eced80c5feaac6a6d5639c0c7cb

  • SHA512

    db5d5870e29bb650aa8e585eba597284a4eb61f98da3fb00e2064a9f8d81ea162f6e86d591860f4cbf6d12f522be7766dd039b53eb23f424d06f9d6d476c4033

  • SSDEEP

    12288:7d3IU8S6eUdQ0OS6s54d7NLErjfkIRS5j71e43Nx/i1FvobY5Ym0X4R7LMc:xItSAdQ0OzscK3R45X1e+Nx/i1FvyyYH

  Score

  10^/10

  agentteslazgratkeyloggerratspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2