Extracted

• • Target

    SecuriteInfo.com.Win32.RATX-gen.14246.10866

  • Size

    890KB

  • MD5

    31654c69d6ff281613694d10f14040f8

  • SHA1

    d47e5c4b893480486932190052ce154ccdbe14ad

  • SHA256

    25ed66335a82f70ae9980bb3f4635398c537b294eeca7728d5994ce9b266ca12

  • SHA512

    c200e50e7726af9ccc70f373bec985ded8855255549c378a93b172bda4c2f37e764cce08cf34d5245b985c7c94a26470e395f336094fecd497139c8fecdf37bc

  • SSDEEP

    12288:RwrPtrlHjVOhefWnE29FPcAqox/P8XHyf+Ivtln0POehoAp:RetrlHjMhd//Eq/0Xy2cn0Wehn

  Score

  10^/10

  agentteslazgratkeyloggerpersistenceratspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2