Extracted

Extracted

• • Target
    QUOTE 609931472XXXXX.exe
  • Size 2.0MB
  • SHA256 f0dee3431ba080ec1fd1975882ae347be81cbb21a81e64ffdf6cc41e14b42fa6
  • MD5 efe9b09099cdec580a506aaad17b9bb6
  • SHA1 b24f0bc38cbc9a5396ede970e94e85ea65754cc0
  • SHA512 5b3705099f0991ff232d985fced45bbbc66767c681e424c3b9aa86924aa525a8930e6b677323f43c729963b3e53a49c0082f1ecb6f7957330ab48d13c7a8f339
  • SSDEEP 24576:l6c/BdNRN4Ag0A32e46XYmRMrH6bId3hpWTsRZDt/kOgOjsaUmkQlthNpA7ocuH8:X6d46XYmRML6bId3hpWTkOOmo
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslazgratkeyloggerpersistenceratspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2