Extracted

• • Target

    a1cf662c445e81ec27bf49d85200cc1142ef655d4a80326e7940c5f9944569ca.exe

  • Size

    1.1MB

  • MD5

    07da191aaf1694030851e095ae5fe747

  • SHA1

    23761afda1ff5dcdf996c8d50993c0060a4ce09d

  • SHA256

    a1cf662c445e81ec27bf49d85200cc1142ef655d4a80326e7940c5f9944569ca

  • SHA512

    7b54adb7a047fc4a85243936c0cfda6acc81292f2a249550bd70fae8771558e54a976acf1d7770b6980f1cb11c41253ec99cef5c3c093c57d76151797d7c84f8

  • SSDEEP

    24576:H4lavt0LkLL9IMixoEgea1qsykyuGeq9MmCS:ikwkn9IMHea1q8zaPCS

  Score

  10^/10

  agentteslazgratkeyloggerratspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2