Extracted

• • Target

    Payment Slip (SWIFT)úPDF.scr.exe

  • Size

    2.8MB

  • MD5

    98eb55275c529b7687b176c76c53a759

  • SHA1

    2819b9d765d4231beafc2f266f1b062665a850f9

  • SHA256

    aa11f352c3358d95bbee240a562519763af7625f4237d13f2764a0a0fa0223d1

  • SHA512

    46b8cd8cff1c2d90266182c9b40bb0587cf6006643f15817279befcb7a4db13e2eef9e385fdde82ce08d83ddbaba483ee7257219247a50edb55da8b5db0657d6

  • SSDEEP

    49152:dU2zbLL2YsJIZk3c42IrDjy/AnzqSppF7Lw8KR1T:Fzb+7Z3NrD+/YqqtK

  Score

  10^/10

  agentteslazgratkeyloggerratspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3behavioral4