Extracted

• • Target

    17b3f8a6958cfba09e44541fd1f6f320e62a04c0aa8f93865c72f72e1d7a11f9

  • Size

    1.5MB

  • MD5

    68a8b64ee9ede9877fe0d841ccf2a758

  • SHA1

    d48c088e9fd147b28e222ab6374582ffe318d9ee

  • SHA256

    17b3f8a6958cfba09e44541fd1f6f320e62a04c0aa8f93865c72f72e1d7a11f9

  • SHA512

    1ff222dfe5e710bb6021904e850e36e36a3ae0f22bc80ddbc06e0d54bce605a4f04b975a8c1e7bed65401a056ba5a22ab87d0742957bccd87c9ec260d05ff83f

  • SSDEEP

    24576:h4lavt0LkLL9IMixoEgea2tbC6z6yk9ukA6/NF4RCg8q9MmCS:wkwkn9IMHea2tbC6z6l9uyFECpaPCS

  Score

  10^/10

  agentteslazgratkeyloggerratspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2