Extracted

• • Target

    SOMGAZ PO NO6200125011.exe

  • Size

    733KB

  • MD5

    1128c941c31bf5c69a05b8ea81f01f43

  • SHA1

    1426e216a1ae8a787104162228ba223feb6940e3

  • SHA256

    ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397

  • SHA512

    7bdb8cf37a4d6dd5554bea5f96ae072fd3d72f8f7357bfa32d09c28a9f8bb193b98398deea2e79ee539b9c3c6fc806cae8b28a5223456c442d21025dd966e68e

  • SSDEEP

    12288:/qBVN+10VUZVz7NB8OhlGdVWelWIy4Y+:/qsBZVfwOhwdQxIy

  Score

  10^/10

  agentteslazgratcollectionkeyloggerratspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2