Overview

overview

10

Static

static

7

x.exe

windows7-x64

10

x.exe

windows10-2004-x64

10

x.exe

windows11-21h2-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    x.exe

  • Size

    867KB

  • Sample

    240328-k61r8ahb7w

  • MD5

    2c520c9db37e16343941bbba36fc22ef

  • SHA1

    b168bb726e9ec94166e60cc3d502843058ede5a4

  • SHA256

    222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a

  • SHA512

    097379427ac91ccde3e7cf09223a8f6a9955c77c786d975e78aa7c5a5e693b92c172322ecc6c32dfc80e4ae2964c805f11ac0268afd95aa82921b296666d758a

  • SSDEEP

    12288:Z6Wq4aaE6KwyF5L0Y2D1PqL/2p7v95HcYuHfWpKbyiJZUHKA4b5:vthEVaPqLOp7v954uMbyiJWHKAK5

Score
10/10
agentteslazgratkeyloggerratspywarestealertrojanupx

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot6811787827:AAEr4cj8xrQKX5i6BnPzE4vzpRaL4EziTo4/

Targets

    • Target

      x.exe

    • Size

      867KB

    • MD5

      2c520c9db37e16343941bbba36fc22ef

    • SHA1

      b168bb726e9ec94166e60cc3d502843058ede5a4

    • SHA256

      222370596f59183040772e971c9b262d1fa1aba5386b448e423c6cff2d23319a

    • SHA512

      097379427ac91ccde3e7cf09223a8f6a9955c77c786d975e78aa7c5a5e693b92c172322ecc6c32dfc80e4ae2964c805f11ac0268afd95aa82921b296666d758a

    • SSDEEP

      12288:Z6Wq4aaE6KwyF5L0Y2D1PqL/2p7v95HcYuHfWpKbyiJZUHKA4b5:vthEVaPqLOp7v954uMbyiJWHKAK5

    Score
    10/10
    agentteslazgratkeyloggerratspywarestealertrojanupx

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix ATT&CK v13

Tasks