Extracted

• • Target

    be62769221f4db9ab152e7c2aebec4c1855f61087381bf75d322ab1f9685c782.exe

  • Size

    2.3MB

  • MD5

    fe703d2fa965479822244b16bb6dc89d

  • SHA1

    1b5f59ee47ff3df701758e4d8fc3ea277006d72c

  • SHA256

    be62769221f4db9ab152e7c2aebec4c1855f61087381bf75d322ab1f9685c782

  • SHA512

    9b96af9ee5f5e6cb84c119d7737fea0c77ba1ea8d68332281a181d66abd08f51e6c853c2028a9a0b8d9136ec619f8d85b4749041d1f3e27be8dc0b6e59bed653

  • SSDEEP

    49152:e/72i9CswGQ7izXQX2KmiYAZ/KW7WbI28uRqj09u:OSipM2zXtqYA4BT8u4g

  Score

  10^/10

  agentteslapurelogstealerzgratkeyloggerratspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect ZGRat V1

  • PureLog Stealer

    PureLog Stealer is an infostealer written in C#.

    stealerpurelogstealer

  • PureLog Stealer payload

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2