Overview

overview

10

Static

static

10

517ee22c4f...d4.exe

windows7-x64

10

517ee22c4f...d4.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    517ee22c4f13794348a1743e39a119c6181b9ce6dff42f7e525fcd9fc2f768d4

  • Size

    355KB

  • Sample

    240329-b7snkaec8w

  • MD5

    c05d1f30c4e092ea20de16c871eca157

  • SHA1

    5aca67a7f815192a972966ab5400a95cdc2e5ed6

  • SHA256

    517ee22c4f13794348a1743e39a119c6181b9ce6dff42f7e525fcd9fc2f768d4

  • SHA512

    055dcc2dfd771600625349a64b572f78777d6e6e9970893b87e9359d4b95c2e3f8ac14cbb11d1892151bc43fb40072b2024c8526c9dbc6c79547873b6d669a0c

  • SSDEEP

    6144:plCXcIbbHRjWje36AmF26qrvuzuzCCdsbXt:plCXLbHRjW+mcOu7ds

Score
10/10
agentteslapurelogstealerzgratkeyloggerpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      517ee22c4f13794348a1743e39a119c6181b9ce6dff42f7e525fcd9fc2f768d4

    • Size

      355KB

    • MD5

      c05d1f30c4e092ea20de16c871eca157

    • SHA1

      5aca67a7f815192a972966ab5400a95cdc2e5ed6

    • SHA256

      517ee22c4f13794348a1743e39a119c6181b9ce6dff42f7e525fcd9fc2f768d4

    • SHA512

      055dcc2dfd771600625349a64b572f78777d6e6e9970893b87e9359d4b95c2e3f8ac14cbb11d1892151bc43fb40072b2024c8526c9dbc6c79547873b6d669a0c

    • SSDEEP

      6144:plCXcIbbHRjWje36AmF26qrvuzuzCCdsbXt:plCXLbHRjW+mcOu7ds

    Score
    10/10
    agentteslapurelogstealerzgratkeyloggerpersistenceratspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Detect ZGRat V1

    • PureLog Stealer

      PureLog Stealer is an infostealer written in C#.

      stealerpurelogstealer

    • PureLog Stealer payload

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks