Overview

overview

10

Static

static

3

chima(1).exe

windows7-x64

10

chima(1).exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d8d456407e90181fffcf4c2cf75d5473cee99e4988cb261368bb4d879729bf33

  • Size

    608KB

  • Sample

    231212-ccmz9sdacm

  • MD5

    c31159744f740252efd0406bd11199eb

  • SHA1

    150e6837865dcc8ee0195e7f45298b58ce29f7ff

  • SHA256

    d8d456407e90181fffcf4c2cf75d5473cee99e4988cb261368bb4d879729bf33

  • SHA512

    852a0dae35531087465c25f47b364bf8ee45d00cd0aa89c285dbc6b5de8fa49bc6680e2e0515b88105fbcba402b1fb7c44bbd1571f7403bcdcbff78050e39cc3

  • SSDEEP

    12288:LVmN5dP68u9twtnmbndmU1DX7G9ku+LB3enB36/tecE:LAXDPmxmqjKYmB36FDE

Score
10/10
agentteslazgratkeyloggerratspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      chima(1).exe

    • Size

      647KB

    • MD5

      cceace4ecb1be92ee5deca9952a4235d

    • SHA1

      43d2e15471c65b8fd68585e611f74d82f3f02c35

    • SHA256

      abdca3519d0c75bbdf734fbefc073a7add76a9cd0a3d07874ddec16edd5fdaf0

    • SHA512

      90f0a2d4a376d5972e9437ca92f18fabdf2eb8eddc4c8d33ba7f5b1402d2644c8af6dd474d335c29994b66d270e0da45f39187c729d53ead4838e2dd746c73ca

    • SSDEEP

      12288:Zw3IU8S6eUdjbB9vq53fUQXELfc9J8/So1lpsXWGfV21enBdGSfzazJvUJHe:ZOItSAdPI3f3XSk9y/HlpsXWGd2IBd/P

    Score
    10/10
    agentteslazgratkeyloggerratspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks