Extracted

• • Target

    5e488c9b956a9b6dfce1aa3309479c30.rtf

  • Size

    70KB

  • MD5

    5e488c9b956a9b6dfce1aa3309479c30

  • SHA1

    f0553cdb501f5a13c829beb433c22ae35e3693c2

  • SHA256

    dd29fa71d454deae29357f4f0771b69413979c149a7bbf3096924f66fe2c5d91

  • SHA512

    08f79f99affbb74b00262b0a3381fdb3aa4459c8be885152385b81d00f8ef8863c19e1a7af7df004de089673513b2be9931ce11897b389edd9a7157ed295bd36

  • SSDEEP

    1536:HUcN5OSn3jEvo2aPvO++EyIN4tiEoKTPsmAxbf:HUcuWPvOBLtiEoKTUmG

  Score

  10^/10

  agentteslazgratkeyloggerratspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2