Overview

overview

10

Static

static

5

bae71457a1...0c.exe

windows7-x64

10

bae71457a1...0c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bae71457a10a552cca3ef795c9370a271d6d8fb54bf9f819a1b2e28abc231c0c

  • Size

    1.1MB

  • Sample

    240312-b4pshacd2y

  • MD5

    dfd696f455965a9e783e895445605c40

  • SHA1

    0cbccb1dd8b2f88ae9bc7debb4afbb63ef1a8ff8

  • SHA256

    bae71457a10a552cca3ef795c9370a271d6d8fb54bf9f819a1b2e28abc231c0c

  • SHA512

    9cf551e97bb86dd7634d7345d159241739a4f51a27635e4b35ad25b5f1902c0eae54ba2e70d1725e65d3df356a492dc0c0e7c7a94a7401d55b27c47be7c2dfa2

  • SSDEEP

    24576:EAHnh+eWsN3skA4RV1Hom2KXMmHa8G+ayDJzqw4Ua/RA5:Th+ZkldoPK8Ya8heD/0

Score
10/10
agentteslazgratkeyloggerratspywarestealertrojan

Malware Config

Targets

    • Target

      bae71457a10a552cca3ef795c9370a271d6d8fb54bf9f819a1b2e28abc231c0c

    • Size

      1.1MB

    • MD5

      dfd696f455965a9e783e895445605c40

    • SHA1

      0cbccb1dd8b2f88ae9bc7debb4afbb63ef1a8ff8

    • SHA256

      bae71457a10a552cca3ef795c9370a271d6d8fb54bf9f819a1b2e28abc231c0c

    • SHA512

      9cf551e97bb86dd7634d7345d159241739a4f51a27635e4b35ad25b5f1902c0eae54ba2e70d1725e65d3df356a492dc0c0e7c7a94a7401d55b27c47be7c2dfa2

    • SSDEEP

      24576:EAHnh+eWsN3skA4RV1Hom2KXMmHa8G+ayDJzqw4Ua/RA5:Th+ZkldoPK8Ya8heD/0

    Score
    10/10
    agentteslazgratkeyloggerratspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks