General

  • Target

    80c76073187068990d79269484424d1b54dc647ab27c4198088fb69bf2050446

  • Size

    346KB

  • Sample

    240129-bfrxysefe6

  • MD5

    d1d37a98787b2fe0220754b09cf3f208

  • SHA1

    155cafaeb7821c2021b49dfbe777e159a2deb5bc

  • SHA256

    80c76073187068990d79269484424d1b54dc647ab27c4198088fb69bf2050446

  • SHA512

    ab2bfb8b7ff1755c68a710b17fb334d1a64b175d8dbeb163643d4884145a56ea6215674ecd9df3500f8b942b29c74864577f413d9265d7f05a1bdf2f27af9929

  • SSDEEP

    6144:W70RDJaMMUTTXr3DyeCTRu+J5iEvAbE2aw4uay:U0RDJaMMUTTXr3DXClEEvjKz

Malware Config

Extracted

Family

agenttesla

Credentials

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

139.84.229.159:2017

Mutex

jhT6lZT93vW5

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      80c76073187068990d79269484424d1b54dc647ab27c4198088fb69bf2050446

    • Size

      346KB

    • MD5

      d1d37a98787b2fe0220754b09cf3f208

    • SHA1

      155cafaeb7821c2021b49dfbe777e159a2deb5bc

    • SHA256

      80c76073187068990d79269484424d1b54dc647ab27c4198088fb69bf2050446

    • SHA512

      ab2bfb8b7ff1755c68a710b17fb334d1a64b175d8dbeb163643d4884145a56ea6215674ecd9df3500f8b942b29c74864577f413d9265d7f05a1bdf2f27af9929

    • SSDEEP

      6144:W70RDJaMMUTTXr3DyeCTRu+J5iEvAbE2aw4uay:U0RDJaMMUTTXr3DXClEEvjKz

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

    • Async RAT payload

MITRE ATT&CK Matrix

Tasks