Extracted

• • Target

    ekstre_pdf.exe

  • Size

    1.2MB

  • MD5

    3ca1479d77a23d47a2f01e8ef30a6365

  • SHA1

    3850b7445cbf81387f910ebe710d0dbdad33a91e

  • SHA256

    074170a0febc20013e9c8cade256a031be328cefc2838f8f6ed394b4caf05b5f

  • SHA512

    e0a6704d19c6afa7e77030d15ad731cb6711988a2814a8f8e9f65e9847d760df071b3d348dba1eb853fa4ec1cf53361a86507ad9b843271b25543ff0d17a60f8

  • SSDEEP

    24576:WAHnh+eWsN3skA4RV1Hom2KXMmHa+rttp28yuTdWJdV5:xh+ZkldoPK8YaIHQ8yKdCh

  Score

  10^/10

  agentteslazgratkeyloggerratspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2