Overview

overview

10

Static

static

5

d3fefa3e2c...5b.exe

windows7-x64

10

d3fefa3e2c...5b.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    d3fefa3e2caa419c12cf2a1600e4c41c465bf932b0ae7c337bfa2fcf5007ae5b

  • Size

    1.2MB

  • Sample

    240124-bpcvdsehd3

  • MD5

    bc64cfefe717bfc87f7c9f45600bfbb1

  • SHA1

    ffecc2a2b387d25e178013eb66f22457ad58f83a

  • SHA256

    d3fefa3e2caa419c12cf2a1600e4c41c465bf932b0ae7c337bfa2fcf5007ae5b

  • SHA512

    b5645dcc166053b3b9b05fdbe2a96cd795d2df829efe67e98cb0d01826dd37f2575c50afa193bae31db88880994135a68321219576a841c2bdc43c6b3416d6de

  • SSDEEP

    24576:/qDEvCTbMWu7rQYlBQcBiT6rprG8aipcUz1nDsFRbryq9EZTYI:/TvC/MTQYxsWR7aipRz4bu

Score
10/10
agentteslazgratkeyloggerratspywarestealertrojan

Malware Config

Targets

    • Target

      d3fefa3e2caa419c12cf2a1600e4c41c465bf932b0ae7c337bfa2fcf5007ae5b

    • Size

      1.2MB

    • MD5

      bc64cfefe717bfc87f7c9f45600bfbb1

    • SHA1

      ffecc2a2b387d25e178013eb66f22457ad58f83a

    • SHA256

      d3fefa3e2caa419c12cf2a1600e4c41c465bf932b0ae7c337bfa2fcf5007ae5b

    • SHA512

      b5645dcc166053b3b9b05fdbe2a96cd795d2df829efe67e98cb0d01826dd37f2575c50afa193bae31db88880994135a68321219576a841c2bdc43c6b3416d6de

    • SSDEEP

      24576:/qDEvCTbMWu7rQYlBQcBiT6rprG8aipcUz1nDsFRbryq9EZTYI:/TvC/MTQYxsWR7aipRz4bu

    Score
    10/10
    agentteslazgratkeyloggerratspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks