agenttesla | 34a45adbca858232e7f3879181c78df27ea6989eac566f971ab5437a7d86dcdc | Triage

Submit
Reports

Overview

overview

Static

static

f8e5bd6d28...18.exe

windows7-x64

f8e5bd6d28...18.exe

windows10-2004-x64

Sharing

General

Target

f8e5bd6d2898a8c9b1f3867f9e58f071_JaffaCakes118
Size

629KB
Sample

240418-2hn7ysgg66
MD5

f8e5bd6d2898a8c9b1f3867f9e58f071
SHA1

fc3a9d8378897fff804728f7869402fef37c9866
SHA256

34a45adbca858232e7f3879181c78df27ea6989eac566f971ab5437a7d86dcdc
SHA512

990f966db11a2a62824c56603bf1f945e2ac1d58dd8461f6ac540c7d13c89b1f9abcf49cba3642de192fd8f0fae6e85ad147f04347f365afc503046cd71fdac9
SSDEEP

12288:RYNNqWjk/9xft2k+uw7od4UNlIkYutjVBy37D/ViXj9tYkCbp:iNfk/9xEkvwT6GkYutRBKAj9mkCbp

Score

10^/10

agenttesla zgrat collection keylogger rat spyware stealer trojan

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

f8e5bd6d2898a8c9b1f3867f9e58f071_JaffaCakes118.exe

Resource

win7-20231129-en

agenttesla zgrat collection keylogger rat spyware stealer trojan

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

f8e5bd6d2898a8c9b1f3867f9e58f071_JaffaCakes118.exe

Resource

win10v2004-20240412-en

agenttesla zgrat collection keylogger rat spyware stealer trojan

windows10-2004-x64

12 signatures

150 seconds

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot1728790391:AAGzyc8dIVEVbURhCAMFPa0FGpI3HdqfdEc/sendDocument

Targets

- Target
  
  f8e5bd6d2898a8c9b1f3867f9e58f071_JaffaCakes118
- Size
  
  629KB
- MD5
  
  f8e5bd6d2898a8c9b1f3867f9e58f071
- SHA1
  
  fc3a9d8378897fff804728f7869402fef37c9866
- SHA256
  
  34a45adbca858232e7f3879181c78df27ea6989eac566f971ab5437a7d86dcdc
- SHA512
  
  990f966db11a2a62824c56603bf1f945e2ac1d58dd8461f6ac540c7d13c89b1f9abcf49cba3642de192fd8f0fae6e85ad147f04347f365afc503046cd71fdac9
- SSDEEP
  
  12288:RYNNqWjk/9xft2k+uw7od4UNlIkYutjVBy37D/ViXj9tYkCbp:iNfk/9xEkvwT6GkYutRBKAj9mkCbp
Score

10^/10

agenttesla zgrat collection keylogger rat spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Detect ZGRat V1
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- AgentTesla payload
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

agentteslazgratcollectionkeyloggerratspywarestealertrojan

behavioral2

agentteslazgratcollectionkeyloggerratspywarestealertrojan

© 2018-2024

Terms | Privacy