Overview

overview

10

Static

static

3

fcfe603466...a7.exe

windows7-x64

10

fcfe603466...a7.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fcfe6034664ca3505264ccd9a6d09930495d818edf638e344ffa5773e5650da7

  • Size

    2.4MB

  • Sample

    240327-b385rahd72

  • MD5

    23b3f588502cd0da3b2c2b2e6370b9dc

  • SHA1

    509c9b0e6b1abd242e52b8e61c33bd89e16e6522

  • SHA256

    fcfe6034664ca3505264ccd9a6d09930495d818edf638e344ffa5773e5650da7

  • SHA512

    e7620257399cbcad87657912fdf03cefc08b1ce0e58d7b68036caef9f951fcdf8af2f5b08f07f9e159f237fa5812bd2363fb011b3f966a45f18aad1ecc58a6be

  • SSDEEP

    49152:iL5AHKOlEt8PWo0hbX54ms3lWXO82KpH:f+8uo0hdns1v82

Score
10/10
agentteslazgratkeyloggerratspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      fcfe6034664ca3505264ccd9a6d09930495d818edf638e344ffa5773e5650da7

    • Size

      2.4MB

    • MD5

      23b3f588502cd0da3b2c2b2e6370b9dc

    • SHA1

      509c9b0e6b1abd242e52b8e61c33bd89e16e6522

    • SHA256

      fcfe6034664ca3505264ccd9a6d09930495d818edf638e344ffa5773e5650da7

    • SHA512

      e7620257399cbcad87657912fdf03cefc08b1ce0e58d7b68036caef9f951fcdf8af2f5b08f07f9e159f237fa5812bd2363fb011b3f966a45f18aad1ecc58a6be

    • SSDEEP

      49152:iL5AHKOlEt8PWo0hbX54ms3lWXO82KpH:f+8uo0hdns1v82

    Score
    10/10
    agentteslazgratkeyloggerratspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks