Extracted

• • Target

    a690fdba2fd0bb532f8556e97759dea39eb2c5b2696720be6119f372b1b65730

  • Size

    719KB

  • MD5

    e0d1ff659ed5cb5e88c0135f73c99294

  • SHA1

    851fef711518b2289d22b1d3649372bdbcbd65ed

  • SHA256

    a690fdba2fd0bb532f8556e97759dea39eb2c5b2696720be6119f372b1b65730

  • SHA512

    d36c01d9e8efec6b07d5d84795488ff5e37fec6be80b40d8a6ab3c82a681adbcf9eadb80ec55315fa8de2a091dec8e5f96a95d3aa5049ab93abb7292deb72d09

  • SSDEEP

    12288:7dgAGe/bZefE7bTD0JYRXRhxP5ej441r+rqsYlqAaRKLycOM9uGf1laGQg/381hX:7tB/cfcTRXRXx4lMq6eWcO0N3/W5p/7V

  Score

  10^/10

  agentteslazgratkeyloggerpersistenceratspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2