Overview

overview

10

Static

static

5

doc20242803125126.exe

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    doc20242803125126.img

  • Size

    1.6MB

  • Sample

    240328-tkbqmsac9v

  • MD5

    ee05d81c85ea65318fdb29f7b8a36439

  • SHA1

    e38beeb011adbc362a6b933ded73c7ffbb82ddca

  • SHA256

    15950c159d16cbd4d69e99f4519c42a973ea0444c74da0be153ef708bc7d48f1

  • SHA512

    f031b129c757a1d3ea0388139503c9b48788ba4ea87e54199b593750dd372461f60cb5036cc10787ce933c6385c5c109c1d0534f0f07cecae5688ed33021f62a

  • SSDEEP

    24576:GRmJkcoQricOIQxiZY1iarshzGuISZlLa6Qjz:DJZoQrbTFZY1iaohauInj

Score
10/10
agentteslazgratkeyloggerratspywarestealertrojan

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    sslout.de
  • Port:
    587
  • Username:
    it@heizoel-menrad.de
  • Password:
    dataset123

Targets

    • Target

      doc20242803125126.bat

    • Size

      1.1MB

    • MD5

      80b5ba36422500dfcfdc3f554b764bbe

    • SHA1

      42b7867a3dc3a1a79293694dd40aa100b6c8fa61

    • SHA256

      361f6fd74a8f73d2dab79c455f734490b415fc4df5dfe1063fbe8c4cfca39e90

    • SHA512

      0a6d740d04d210e28b21cb953af305625a416f878552408713d25194058177b59857294f9f5025ea834a66ccbfaa3a3c144c877fc1f3af21236c3b730a2dba94

    • SSDEEP

      24576:eRmJkcoQricOIQxiZY1iarshzGuISZlLa6Qjz6:LJZoQrbTFZY1iaohauInjW

    Score
    10/10
    agentteslazgratkeyloggerratspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Tasks