Overview

overview

10

Static

static

5

16b790ad37...e1.exe

windows7-x64

1

16b790ad37...e1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    16b790ad37c38e92e2f7b102d2d622dd6a1e51f9614c72f404272536e4785be1.exe

  • Size

    1.1MB

  • Sample

    240419-n6qh2aca6z

  • MD5

    88e1a2d19bd93d64e6a3675c404bf424

  • SHA1

    4199075cc9c375b7a1dd85ab701e5fab010136eb

  • SHA256

    16b790ad37c38e92e2f7b102d2d622dd6a1e51f9614c72f404272536e4785be1

  • SHA512

    624e41236aac0a35eaf694f4ffa81a59a4992c86235c5494027f821172312b2566c20734b486421d948ddfd034e483778aadc91ffb93615382e48bc761f57f0b

  • SSDEEP

    24576:+AHnh+eWsN3skA4RV1Hom2KXMmHaKBb6Nk8QWbVLjgT7gx5:ph+ZkldoPK8YaKJykiJLj+q

Score
10/10
agentteslazgratkeyloggerratspywarestealertrojan

Malware Config

Targets

    • Target

      16b790ad37c38e92e2f7b102d2d622dd6a1e51f9614c72f404272536e4785be1.exe

    • Size

      1.1MB

    • MD5

      88e1a2d19bd93d64e6a3675c404bf424

    • SHA1

      4199075cc9c375b7a1dd85ab701e5fab010136eb

    • SHA256

      16b790ad37c38e92e2f7b102d2d622dd6a1e51f9614c72f404272536e4785be1

    • SHA512

      624e41236aac0a35eaf694f4ffa81a59a4992c86235c5494027f821172312b2566c20734b486421d948ddfd034e483778aadc91ffb93615382e48bc761f57f0b

    • SSDEEP

      24576:+AHnh+eWsN3skA4RV1Hom2KXMmHaKBb6Nk8QWbVLjgT7gx5:ph+ZkldoPK8YaKJykiJLj+q

    Score
    10/10
    agentteslazgratkeyloggerratspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks