Overview

overview

10

Static

static

3

1f8a28e9ee...88.exe

windows7-x64

10

1f8a28e9ee...88.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    1f8a28e9eea19313c1d5453a4b292788

  • Size

    497KB

  • Sample

    231225-bkgb1shda9

  • MD5

    1f8a28e9eea19313c1d5453a4b292788

  • SHA1

    51e8b4e4f328bd95d05a783bc953d720d10ea3d1

  • SHA256

    f465787fcece594aab905f5b32772c2125fbaebc2dd0c27ab1117e2056648e0f

  • SHA512

    a455fcd1a516cde545bbd0e23651188c955f92673ccdb1106ea8c862f454af089746e7fc7712808ada591a2f575400b753caca018c82b956b20cef17850483a0

  • SSDEEP

    6144:arDaY05qwyS6SmNMqt6snMU8Jj/QydRqB2imKOyI6jTvlyTQmocbx3NVvNJI2fr/:6IUFS6Smt7r2j/QxklEAEaVVJbLWe

Score
10/10
agentteslazgratkeyloggerpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.jetport-aero.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Niniola@456

Targets

    • Target

      1f8a28e9eea19313c1d5453a4b292788

    • Size

      497KB

    • MD5

      1f8a28e9eea19313c1d5453a4b292788

    • SHA1

      51e8b4e4f328bd95d05a783bc953d720d10ea3d1

    • SHA256

      f465787fcece594aab905f5b32772c2125fbaebc2dd0c27ab1117e2056648e0f

    • SHA512

      a455fcd1a516cde545bbd0e23651188c955f92673ccdb1106ea8c862f454af089746e7fc7712808ada591a2f575400b753caca018c82b956b20cef17850483a0

    • SSDEEP

      6144:arDaY05qwyS6SmNMqt6snMU8Jj/QydRqB2imKOyI6jTvlyTQmocbx3NVvNJI2fr/:6IUFS6Smt7r2j/QxklEAEaVVJbLWe

    Score
    10/10
    agentteslazgratkeyloggerpersistenceratspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Detect ZGRat V1

    • Modifies WinLogon for persistence

      persistence

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • AgentTesla payload

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks