Overview

overview

10

Static

static

3

ShippingOr...52.exe

windows7-x64

10

ShippingOr...52.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ShippingOrder_ GSHS2400052.exe

  • Size

    185KB

  • Sample

    240420-fejbmshf7v

  • MD5

    5a9bf748b2b3431b39e5a8fea6feaa80

  • SHA1

    08a558eb27295a8e3f70a7a05cf958e2907fd970

  • SHA256

    3801a5a9dd369ed4fefc953437c2059d00da7b98fabd3ec68262ef48f9718bcf

  • SHA512

    caa42a2ea17c2ca98812478dd5739479be6fee0c243401c08003092749b1848b4090b7470f9f6641219b9696cccfecebfc2497e2d7fc8200fb833a13bbe0e022

  • SSDEEP

    3072:fcGYpXxZwveS8lH9YYLI42pVWse3Ns6G2FxgiNCJmPG04:EGYpvwveMYpBRFxgvh

Score
10/10
agentteslazgratkeyloggerratspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.iaa-airferight.com
  • Port:
    587
  • Username:
    mail@iaa-airferight.com
  • Password:
    Asaprocky11
  • Email To:
    web@iaa-airferight.com

Targets

    • Target

      ShippingOrder_ GSHS2400052.exe

    • Size

      185KB

    • MD5

      5a9bf748b2b3431b39e5a8fea6feaa80

    • SHA1

      08a558eb27295a8e3f70a7a05cf958e2907fd970

    • SHA256

      3801a5a9dd369ed4fefc953437c2059d00da7b98fabd3ec68262ef48f9718bcf

    • SHA512

      caa42a2ea17c2ca98812478dd5739479be6fee0c243401c08003092749b1848b4090b7470f9f6641219b9696cccfecebfc2497e2d7fc8200fb833a13bbe0e022

    • SSDEEP

      3072:fcGYpXxZwveS8lH9YYLI42pVWse3Ns6G2FxgiNCJmPG04:EGYpvwveMYpBRFxgvh

    Score
    10/10
    zgratratagentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • .NET Reactor proctector

      Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks