Overview

overview

10

Static

static

10

CashRAT.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

Errors

Reason
too many matches

General

  • Target

    CashRAT.exe

  • Size

    483.2MB

  • MD5

    d40af8478e2ffe4d3ea1a6388fc3fd80

  • SHA1

    e7273e3df7b6dc63daa27dbac66730b6b6fcb54d

  • SHA256

    bfe5490db6bed7a2d9650a056b57e086d04fd0d46ac1b6aa9ffbede18436ff45

  • SHA512

    64991f45ef9d91954f0b08b02fad861f18bd1f86b03a2185d2adc549263eb78c9df76672c8e9b7cfe6fb97903aa701d0ddbdf84351cbeaa27c0809e8a2602470

  • SSDEEP

    6291456:3FkRA9FkRQfXWi2mBxRSkDqEe1YsPDbSxsZEn8uFGiQT8aBCw:+ZwamhSkeNXMw

Score
10/10
agentteslazgrat

Malware Config

Signatures

  • AgentTesla payload 1 IoCs
  • Agenttesla family
    agenttesla
  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect ZGRat V1 1 IoCs
  • Nirsoft 1 IoCs
  • Zgrat family
    zgrat
  • CustAttr .NET packer 1 IoCs

    Detects CustAttr .NET packer in memory.

  • .NET Reactor proctector 1 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • CashRAT.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections