Extracted

• • Target
    be62769221f4db9ab152e7c2aebec4c1855f61087381bf75d322ab1f9685c782.exe
  • Size 2.3MB
  • SHA256 be62769221f4db9ab152e7c2aebec4c1855f61087381bf75d322ab1f9685c782
  • MD5 fe703d2fa965479822244b16bb6dc89d
  • SHA1 1b5f59ee47ff3df701758e4d8fc3ea277006d72c
  • SHA512 9b96af9ee5f5e6cb84c119d7737fea0c77ba1ea8d68332281a181d66abd08f51e6c853c2028a9a0b8d9136ec619f8d85b4749041d1f3e27be8dc0b6e59bed653
  • SSDEEP 49152:e/72i9CswGQ7izXQX2KmiYAZ/KW7WbI28uRqj09u:OSipM2zXtqYA4BT8u4g
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslapurelogstealerzgratkeyloggerratspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect ZGRat V1

  • PureLog Stealer

    PureLog Stealer is an infostealer written in C#.

    stealerpurelogstealer

  • PureLog Stealer payload

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Detect packed .NET executables. Mostly AgentTeslaV4.

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

  • Detects executables referencing Windows vault credential objects. Observed in infostealers

  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

  • Detects executables referencing many email and collaboration clients. Observed in information stealers

  • Detects executables referencing many file transfer clients. Observed in information stealers

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2