agenttesla

General

Target

INQUIRY PDF.tgz
Size

1.5MB
Sample

231211-lvv82abden
MD5

88b93edb04dbfb83cfc33cb4f930e521
SHA1

9b8a4371622fc8ac62708846941c0e38bbd1b2b2
SHA256

2d1518e380ad0097d9e3b182bba0d826ffb26000e4aac79000ce3d0df6a8e270
SHA512

b5d27f0440ad26fa138c9364b99d1f8476cad450f95ec94e18d3d5e01617bdbb8fa3630392572edaf3d9b3a6a3824984c7334a922df32cede2c72f92140fd56e
SSDEEP

12288:FwQ/7vpVvPyWI9tF6mKz6bmXD4bqFR/P9WgIM:KQjpVXyLD6ibMkeFV

Score

10^/10

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot6613050989:AAFzqaU0JrKNv_WqHvgGwJ2x2m8dKJc8reM/

Targets

- Target
  
  JTIpTAyy1lSKDJd.exe
- Size
  
  906.0MB
- MD5
  
  6304c8a4c9527e0c3464faf3c6fbe907
- SHA1
  
  5e09efa23d653b9ade5e3f98afa4601bee634fb7
- SHA256
  
  a06c1b4b2bf727b7ed1f54064192c40bb5ba7e3f0d9c8c0e1cc2c760a087a907
- SHA512
  
  cea84804a2e2eb2aa0a1cdf955e2b076c6e04b0f4a9ffe8d7ebbc7e71c122fd03504c8c41d3dd5a11265caa6a480b1d729182146497f87ed5a7910fa2a809c69
- SSDEEP
  
  12288:P3IU8S6eUd5o9tHU4cKf6XY1DUNqhDksRW7mfK04/5GJ5:/ItSAd+24UXWYchqr0Gk5
Score

10^/10

agenttesla zgrat keylogger rat spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Detect ZGRat V1
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

3

T1552

Credentials In Files

3

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect ZGRat V1

ZGRat

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

We care about your privacy.