Overview

overview

10

Static

static

5

3fb4903b94...1a.exe

windows7-x64

10

3fb4903b94...1a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3fb4903b9429a85b65f816eb8f90a3ae01eb38eef3ebb5f622587af468173d1a

  • Size

    1.2MB

  • Sample

    240330-bhsx2adf21

  • MD5

    1b453ca9236f5b70f3c7c255eba1c45a

  • SHA1

    9e66fb5257155f5b44d8b8f24ab377b0f47aaba8

  • SHA256

    3fb4903b9429a85b65f816eb8f90a3ae01eb38eef3ebb5f622587af468173d1a

  • SHA512

    eacb7952a901b5fde0f0e6f0ba46b2313d0e13d63fab4fee57115c4c6dd476e7bcbeb0f96f24d2795a4624001c4e562730985dac8d4befc3ed88c997053434d6

  • SSDEEP

    24576:oqDEvCTbMWu7rQYlBQcBiT6rprG8a55MZisxzKqoa+:oTvC/MTQYxsWR7a55Cua

Score
10/10
agentteslazgratkeyloggerratspywarestealertrojan

Malware Config

Targets

    • Target

      3fb4903b9429a85b65f816eb8f90a3ae01eb38eef3ebb5f622587af468173d1a

    • Size

      1.2MB

    • MD5

      1b453ca9236f5b70f3c7c255eba1c45a

    • SHA1

      9e66fb5257155f5b44d8b8f24ab377b0f47aaba8

    • SHA256

      3fb4903b9429a85b65f816eb8f90a3ae01eb38eef3ebb5f622587af468173d1a

    • SHA512

      eacb7952a901b5fde0f0e6f0ba46b2313d0e13d63fab4fee57115c4c6dd476e7bcbeb0f96f24d2795a4624001c4e562730985dac8d4befc3ed88c997053434d6

    • SSDEEP

      24576:oqDEvCTbMWu7rQYlBQcBiT6rprG8a55MZisxzKqoa+:oTvC/MTQYxsWR7a55Cua

    Score
    10/10
    agentteslazgratkeyloggerratspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks