Overview

overview

10

Static

static

1

QUOTATION_...DF.scr

windows7-x64

10

QUOTATION_...DF.scr

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    TRASMISSIONE NS ORDINE NR S34 RIF. PETRILLI A.z

  • Size

    2.1MB

  • Sample

    240313-s7ev5sgh3w

  • MD5

    485c22eaac3cc8298383b533c2fe370b

  • SHA1

    70a036dde5d2fb9812a0c6efc252b5c738879301

  • SHA256

    f3b845d97dc4f67e6e99f50343a1a69a1985ba35fefd8ad20590577f79b4aeb0

  • SHA512

    a1666a17a82a0da116cf3f4799d54923c8d2d9cd41d09a2a2f6c74af4dc9153cd69f40847bec139d7cfb7b489db316f2a1a24d0fe8a714ed41b175380d8aa04b

  • SSDEEP

    49152:3+6sK3FkB2EfekPDtkIyUcgUKrG1Lsoynrg1pL6hZFJZV4F0Oe+:353GzWgDGjUcgBXzhzZY0O1

Score
10/10
agentteslazgratkeyloggerratspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      QUOTATION_MARQTRA031244PDF.scr

    • Size

      2.3MB

    • MD5

      07e69fa42a4821aad667f339471bd310

    • SHA1

      3015b1978f06d7898ac9485d361213b955cb9b2d

    • SHA256

      bf9d20d99da73a2ca91870763627b1c05d97bf401617d35d5f407e30ab412f22

    • SHA512

      9c95c4e7ad6e3d8131867b0f70043e137d46852617b65adcf28cb7d5cbdaf25a9a966da647e927f5b536318baef8b9a7447ecfa3598f33de3ca99c71e9083101

    • SSDEEP

      49152:WsCjGxPVtMZrmNaMMuPYHw+wE1M1JZgB/I4VFP6Pnef2MT2Gq0Rl5:xCjGvtM1F5ugHwxEUJe632fp2s

    Score
    10/10
    agentteslazgratkeyloggerratspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks