Overview

overview

10

Static

static

5

e4ca1ae0fe...64.exe

windows7-x64

10

e4ca1ae0fe...64.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e4ca1ae0fec43bd86bb5b21602f2ae96d8c50d477ce4ebf30138cd289b13cc64

  • Size

    1.1MB

  • Sample

    240306-bfmy1afg88

  • MD5

    15c1b100f174260e96c6b1157851cdf2

  • SHA1

    52698979db01b42e0a9a0d6427512398bcb693fc

  • SHA256

    e4ca1ae0fec43bd86bb5b21602f2ae96d8c50d477ce4ebf30138cd289b13cc64

  • SHA512

    ac71bb8a0f3ad5b11535e2974eb30c37248f8f92788359b9f50c2a4cabbe7d896db41c244f986b55e08dcb34db65a46a9c99439bca333e930dd6e2124973979f

  • SSDEEP

    12288:Itb20Qc3lT7af41ePBRYuQLKpqeUhbTv5OFgNuPPpHSgaTTltuXOjroDm+2SsliH:Itb20pkaCqT5TBWgNQ7anlYCDox6A

Score
10/10
agentteslazgratkeyloggerratspywarestealertrojan

Malware Config

Targets

    • Target

      e4ca1ae0fec43bd86bb5b21602f2ae96d8c50d477ce4ebf30138cd289b13cc64

    • Size

      1.1MB

    • MD5

      15c1b100f174260e96c6b1157851cdf2

    • SHA1

      52698979db01b42e0a9a0d6427512398bcb693fc

    • SHA256

      e4ca1ae0fec43bd86bb5b21602f2ae96d8c50d477ce4ebf30138cd289b13cc64

    • SHA512

      ac71bb8a0f3ad5b11535e2974eb30c37248f8f92788359b9f50c2a4cabbe7d896db41c244f986b55e08dcb34db65a46a9c99439bca333e930dd6e2124973979f

    • SSDEEP

      12288:Itb20Qc3lT7af41ePBRYuQLKpqeUhbTv5OFgNuPPpHSgaTTltuXOjroDm+2SsliH:Itb20pkaCqT5TBWgNQ7anlYCDox6A

    Score
    10/10
    agentteslazgratkeyloggerratspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks