Overview

overview

10

Static

static

3

2379cd8754...20.exe

windows7-x64

10

2379cd8754...20.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2379cd8754bf33dcd8ae50910b7b9e65828ae0f018861a13807b3088f0d36220

  • Size

    2.7MB

  • Sample

    240330-blcp8aed89

  • MD5

    616a5cb06cac99fd449f196aacc9ea48

  • SHA1

    20228398ef3d1041c31285b0daa175fe032cfb24

  • SHA256

    2379cd8754bf33dcd8ae50910b7b9e65828ae0f018861a13807b3088f0d36220

  • SHA512

    a20dd4872f3638558f4de1f0ba9684b085e42bcf9160e8f2e58ea72c67e400e8355b5ebfda3ae8db2ee3abfb643a85c51bb8328cd2af9c0173fdecbdd34be530

  • SSDEEP

    49152:DZ7It4w4EXzZH4JJN8qiZr4G0Q28jwUAWEwfCbSSGrnNP9FD4szH5W2hcn96rrrB:WBXpcN8qi14G0Q28jwUAWEwfCbSSGDNH

Score
10/10
agentteslazgratkeyloggerratspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      2379cd8754bf33dcd8ae50910b7b9e65828ae0f018861a13807b3088f0d36220

    • Size

      2.7MB

    • MD5

      616a5cb06cac99fd449f196aacc9ea48

    • SHA1

      20228398ef3d1041c31285b0daa175fe032cfb24

    • SHA256

      2379cd8754bf33dcd8ae50910b7b9e65828ae0f018861a13807b3088f0d36220

    • SHA512

      a20dd4872f3638558f4de1f0ba9684b085e42bcf9160e8f2e58ea72c67e400e8355b5ebfda3ae8db2ee3abfb643a85c51bb8328cd2af9c0173fdecbdd34be530

    • SSDEEP

      49152:DZ7It4w4EXzZH4JJN8qiZr4G0Q28jwUAWEwfCbSSGrnNP9FD4szH5W2hcn96rrrB:WBXpcN8qi14G0Q28jwUAWEwfCbSSGDNH

    Score
    10/10
    agentteslazgratkeyloggerratspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks