Extracted

• • Target

    b48a1be74fa295306d499815bfac2071feee2573c226758f75287d667514f83d

  • Size

    1.3MB

  • MD5

    59d981ed9028d3247ef3fca52e62b117

  • SHA1

    e3e3d5233b2665cfdba8caac7ce36b46250bc0f6

  • SHA256

    b48a1be74fa295306d499815bfac2071feee2573c226758f75287d667514f83d

  • SHA512

    7f3501e07048a11e6df67806d67fa7078cb798267b944b0269dbe7b80730d1258104d74fc4e5512316624034148116c7020972ac6c3ba3d176e9c78264d17c5c

  • SSDEEP

    24576:4qDEvCTbMWu7rQYlBQcBiT6rprG8aQ1CCjqxkKqTBAEnLrhX:4TvC/MTQYxsWR7aQ8Cmx5qrh

  Score

  10^/10

  agentteslazgratkeyloggerpersistenceratspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2