Overview

overview

10

Static

static

10

RAGEMP_TOOL.exe

windows7-x64

7

RAGEMP_TOOL.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    RAGEMP_TOOL.exe

  • Size

    8.0MB

  • Sample

    240328-wvcf2acf9x

  • MD5

    8bf8265cd31369984dfd20add816eb8c

  • SHA1

    e07748c7f112318b916d88139edc44fb6110785f

  • SHA256

    23ca424b5c77866d5f1258192cd442c2142dc9abd9f94bd31ca34cb603ea36b0

  • SHA512

    8a88316f4b11aa5265a1a7716ec2246bc9dd0f39d21ac29a4cdf1b97f5fe0129d73d15fa49e0d37909bec84d7312e9919b45b47b84a1999430af9b2785735dd5

  • SSDEEP

    196608:FyQsbNIOKToqPosbT/9bvLz3S1bA3zgn97vz:+bpqAsbTlj3S1bOzgZvz

Score
10/10
agentteslablankgrabberkeyloggerspywarestealertrojanupx

Malware Config

Targets

    • Target

      RAGEMP_TOOL.exe

    • Size

      8.0MB

    • MD5

      8bf8265cd31369984dfd20add816eb8c

    • SHA1

      e07748c7f112318b916d88139edc44fb6110785f

    • SHA256

      23ca424b5c77866d5f1258192cd442c2142dc9abd9f94bd31ca34cb603ea36b0

    • SHA512

      8a88316f4b11aa5265a1a7716ec2246bc9dd0f39d21ac29a4cdf1b97f5fe0129d73d15fa49e0d37909bec84d7312e9919b45b47b84a1999430af9b2785735dd5

    • SSDEEP

      196608:FyQsbNIOKToqPosbT/9bvLz3S1bA3zgn97vz:+bpqAsbTlj3S1bOzgZvz

    Score
    10/10
    upxagentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla payload

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

1
T1057

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks