Extracted

• • Target

    cb566a6496bd16540e99f5549dba94a0840aefe1a2cc284822ab0eab6c5198dd

  • Size

    66KB

  • MD5

    a542749ade83d32b48a918ff93413e01

  • SHA1

    690f8022323066694d9c82851273c6e39f8b90c9

  • SHA256

    cb566a6496bd16540e99f5549dba94a0840aefe1a2cc284822ab0eab6c5198dd

  • SHA512

    6e54087cff93209691f2e418346f6bcf03646f35f6805a6f3d754a47e4488fdfaa451978b96da719839231eef92e1db4942b59ad8c457472b078d94c9ce0ed55

  • SSDEEP

    1536:ybJT7XskGBXK3wDu3Y6Uk9jg+rr6GbOsKpeQiQKWOtnoHeix:MsxBnDud7r6GiX8QiQ/OtDm

  Score

  10^/10

  agentteslazgratcollectionkeyloggerpersistenceratspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Detect packed .NET executables. Mostly AgentTeslaV4.

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Detects executables referencing Windows vault credential objects. Observed in infostealers

  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

  • Detects executables referencing many email and collaboration clients. Observed in information stealers

  • Detects executables referencing many file transfer clients. Observed in information stealers

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2