Extracted

• • Target

    8a87a45dbcd63ff898d2c7087da7c448a137ff54f894e5b4251bd25801effedf

  • Size

    1.2MB

  • MD5

    1a9eac67f2179d3f75bce5484e27b7db

  • SHA1

    14919c527ba421a21c68ecd2bde083850f5323d6

  • SHA256

    8a87a45dbcd63ff898d2c7087da7c448a137ff54f894e5b4251bd25801effedf

  • SHA512

    f95d211d22e195939a8ed0074b038ed7788b2bf559fd3205c02dc8bd1f009d006e6acddf9ffee7701994c5512997ec56dfb0a06634c4432c818827c093dc63cb

  • SSDEEP

    24576:zRmJkcoQricOIQxiZY1WNsQp7v954uMbyiJWHKAK5:AJZoQrbTFZY1WNsQ99quMbyfqx

  Score

  10^/10

  agentteslazgratkeyloggerratspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2