Extracted

Extracted

• • Target
    DEKONT-20-02-2024-987667890987654567898765678987656780DOC.exe
  • Size 674KB
  • SHA256 10045da87a68ac04e22f9e9f69388c170f05d4f65a444221c53534d7710eb0bc
  • MD5 47dc5e184fbc02b2a7742433041bd32c
  • SHA1 bec6d3fdcad034ce72cae33f4795fea9e14c4d87
  • SHA512 72db657e2e84f6ac15defe419f3bb5393ac3f7469caa0428a6fb4b16f04e083b5dfe7994bd4f59e59ef94be2426b6d087e44f0033b98bd9ab69d24051084da43
  • SSDEEP 12288:fv25CsC4vLqFIRheaXv4ansjCPpECFf2T3Ehe11yDs9yi+vFj0oQMc:325PCQOSOKnnsa+C/e11yol+dHJ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslazgratkeyloggerratspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2