Overview

overview

10

Static

static

5

1a3145d706...dd.exe

windows7-x64

10

1a3145d706...dd.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1a3145d70626ce8657ae682f6ad1220504e839525aded527ec858258b866eddd

  • Size

    1.2MB

  • Sample

    240330-bk2mysed79

  • MD5

    dfc0216bdfbf9febb356c1efdec01862

  • SHA1

    cfdac67fcfe8cfe5b4226fb6c48c7c6939b52e09

  • SHA256

    1a3145d70626ce8657ae682f6ad1220504e839525aded527ec858258b866eddd

  • SHA512

    0575259a955aecdc56f0ffc9ff272ead62dbcefbab7abdeeb2060ec86cc4525ebe4a3a8efdeffb2d4cb92aa9f1e45538d2f8ef1ef1f64021563f28e6038673b4

  • SSDEEP

    24576:kqDEvCTbMWu7rQYlBQcBiT6rprG8aSDXuRPC6:kTvC/MTQYxsWR7aSiRP

Score
10/10
agentteslazgratkeyloggerratspywarestealertrojan

Malware Config

Targets

    • Target

      1a3145d70626ce8657ae682f6ad1220504e839525aded527ec858258b866eddd

    • Size

      1.2MB

    • MD5

      dfc0216bdfbf9febb356c1efdec01862

    • SHA1

      cfdac67fcfe8cfe5b4226fb6c48c7c6939b52e09

    • SHA256

      1a3145d70626ce8657ae682f6ad1220504e839525aded527ec858258b866eddd

    • SHA512

      0575259a955aecdc56f0ffc9ff272ead62dbcefbab7abdeeb2060ec86cc4525ebe4a3a8efdeffb2d4cb92aa9f1e45538d2f8ef1ef1f64021563f28e6038673b4

    • SSDEEP

      24576:kqDEvCTbMWu7rQYlBQcBiT6rprG8aSDXuRPC6:kTvC/MTQYxsWR7aSiRP

    Score
    10/10
    agentteslazgratkeyloggerratspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks