Extracted

Extracted

• • Target
    ryNbjqznxgwb.exe
  • Size 2.3MB
  • SHA256 98d34263254e4b691f6263c8d58981cbca971497c1d2504ffb2d8e55c857d28c
  • MD5 6cdb9b3646fbefc111393b9e6834ee90
  • SHA1 dca4d194ae5a0cf8b3a5e556d01a893d4855057d
  • SHA512 fa6b79328402a57f431afcf8b546e0264460e809f2fd490532c027890fb775924d0a6121e7faa687ac55242ae4c9764f36b496a8f336ec2b52dd57c37bd8596b
  • SSDEEP 49152:Dz83C0oao0ONh96WVunTgieqN9xBaxwNk1Ysm:P6C0a0y9rVuUFyRaxWGYr
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslapurelogstealerzgratkeyloggerratspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect ZGRat V1

  • PureLog Stealer

    PureLog Stealer is an infostealer written in C#.

    stealerpurelogstealer

  • PureLog Stealer payload

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2