Overview

overview

10

Static

static

5

2aee8baffb...4b.exe

windows7-x64

10

2aee8baffb...4b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2aee8baffb17cee74351abf00ad2858483fd0e12a8fa9f2bbd127e122a5ae14b

  • Size

    1.2MB

  • Sample

    240328-cc3qqacg71

  • MD5

    13ec5e21374731ff841ec06417425a7e

  • SHA1

    ff55f14570b31b700e25cfebac90e7efe850f15b

  • SHA256

    2aee8baffb17cee74351abf00ad2858483fd0e12a8fa9f2bbd127e122a5ae14b

  • SHA512

    9e0e04c800a96101a63b3b2f8c01cb9039606c4d46d87679a6ecd4bcfaa673da6f24151b60e53bb3f82cbf25bb3257d4b6c54be0afcdb51728c932fa9e92f2ef

  • SSDEEP

    24576:bAHnh+eWsN3skA4RV1Hom2KXMmHaB6i+ITlQBWYjgBg5:2h+ZkldoPK8YaBlHl0zjr

Score
10/10
agentteslazgratkeyloggerratspywarestealertrojan

Malware Config

Targets

    • Target

      2aee8baffb17cee74351abf00ad2858483fd0e12a8fa9f2bbd127e122a5ae14b

    • Size

      1.2MB

    • MD5

      13ec5e21374731ff841ec06417425a7e

    • SHA1

      ff55f14570b31b700e25cfebac90e7efe850f15b

    • SHA256

      2aee8baffb17cee74351abf00ad2858483fd0e12a8fa9f2bbd127e122a5ae14b

    • SHA512

      9e0e04c800a96101a63b3b2f8c01cb9039606c4d46d87679a6ecd4bcfaa673da6f24151b60e53bb3f82cbf25bb3257d4b6c54be0afcdb51728c932fa9e92f2ef

    • SSDEEP

      24576:bAHnh+eWsN3skA4RV1Hom2KXMmHaB6i+ITlQBWYjgBg5:2h+ZkldoPK8YaBlHl0zjr

    Score
    10/10
    agentteslazgratkeyloggerratspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks