Overview

overview

10

Static

static

5

52826106b0...2c.exe

windows7-x64

10

52826106b0...2c.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    52826106b0604a8fbe4da3ad9ebac57130933d40b1d3902888c5925b6386172c

  • Size

    1.1MB

  • Sample

    240313-c1rclaae4y

  • MD5

    9ff1e54eaae2ffff004ac886a02e049b

  • SHA1

    28756ecde5bf9ff9bb7bf78d76e490667190e390

  • SHA256

    52826106b0604a8fbe4da3ad9ebac57130933d40b1d3902888c5925b6386172c

  • SHA512

    924411198f22f21db97019a9de96eda7e6b699895adfb278d60335921ebe2761c9d698585af501a8614fefedd741fccb025f429ded66b78c2b3e959fc7a08969

  • SSDEEP

    24576:CAHnh+eWsN3skA4RV1Hom2KXMmHaBPaaSZsnaeb5:Fh+ZkldoPK8YaBPaR1C

Score
10/10
agentteslazgratkeyloggerratspywarestealertrojan

Malware Config

Targets

    • Target

      52826106b0604a8fbe4da3ad9ebac57130933d40b1d3902888c5925b6386172c

    • Size

      1.1MB

    • MD5

      9ff1e54eaae2ffff004ac886a02e049b

    • SHA1

      28756ecde5bf9ff9bb7bf78d76e490667190e390

    • SHA256

      52826106b0604a8fbe4da3ad9ebac57130933d40b1d3902888c5925b6386172c

    • SHA512

      924411198f22f21db97019a9de96eda7e6b699895adfb278d60335921ebe2761c9d698585af501a8614fefedd741fccb025f429ded66b78c2b3e959fc7a08969

    • SSDEEP

      24576:CAHnh+eWsN3skA4RV1Hom2KXMmHaBPaaSZsnaeb5:Fh+ZkldoPK8YaBPaR1C

    Score
    10/10
    agentteslazgratkeyloggerratspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks