Extracted

• • Target

    dbf70f863f2d0dd847bf23b929faf542880c0d72ecc9698ab33343ecd73a04be.exe

  • Size

    54KB

  • MD5

    e480e22b9d128a0235bfa26417b149b6

  • SHA1

    2c40a4778a6af579cb1ccb6e2263d7e070d1beea

  • SHA256

    dbf70f863f2d0dd847bf23b929faf542880c0d72ecc9698ab33343ecd73a04be

  • SHA512

    0811bd96dce609fe618a3e225b5e517c6eba2e8a1492b82320be093c90f6634c30c1005628414ef567e5bbb10171439ab00a97d0943df5b95429260354fcde11

  • SSDEEP

    768:+e1Qq5r5gIcCT4BuzDOZ0dkfJmKhTf9q9cWpYqWSEANwkiZEXKexucbdmKvVeZWL:11b5lgI9vxdkMaxTBbHZEciUKvVe4L

  Score

  10^/10

  agentteslazgratkeyloggerpersistenceratspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Detect packed .NET executables. Mostly AgentTeslaV4.

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

  • Detects executables referencing Windows vault credential objects. Observed in infostealers

  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

  • Detects executables referencing many email and collaboration clients. Observed in information stealers

  • Detects executables referencing many file transfer clients. Observed in information stealers

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2