agenttesla | e4742ef466dd828202db9a22bee89a4835b3e3600a202da218c42a44610a2bc0 | Triage

Submit
Reports

Overview

overview

Static

static

5

e4742ef466...c0.exe

windows7-x64

e4742ef466...c0.exe

windows10-2004-x64

Sharing

General

Target

e4742ef466dd828202db9a22bee89a4835b3e3600a202da218c42a44610a2bc0
Size

1.1MB
Sample

240425-b4st6ada66
MD5

d90b4dbea769da538ed3e81d35f5ac9e
SHA1

294b4c72e4c65660cb47e07b9409b91deb183da6
SHA256

e4742ef466dd828202db9a22bee89a4835b3e3600a202da218c42a44610a2bc0
SHA512

88513629125268e52075f5ecbff042999b6f870b4a1fe3a01f5e3a55bd99fca62323ea0e9c52d2cae15a6ee9d488afd56544655d7f7f5e6b06496169174f1844
SSDEEP

24576:eqDEvCTbMWu7rQYlBQcBiT6rprG8aoVEKLfAEo4Zcu+AsNw:eTvC/MTQYxsWR7aojAuY

Score

10^/10

agenttesla zgrat keylogger persistence rat spyware stealer trojan

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

e4742ef466dd828202db9a22bee89a4835b3e3600a202da218c42a44610a2bc0.exe

Resource

win7-20240220-en

agenttesla zgrat keylogger persistence rat spyware stealer trojan

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

e4742ef466dd828202db9a22bee89a4835b3e3600a202da218c42a44610a2bc0.exe

Resource

win10v2004-20240226-en

agenttesla zgrat keylogger persistence rat spyware stealer trojan

windows10-2004-x64

12 signatures

150 seconds

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
mail.deeptrans.com.tr
Port:
587
Username:
[email protected]
Password:
59ace821A

Targets

- Target
  
  e4742ef466dd828202db9a22bee89a4835b3e3600a202da218c42a44610a2bc0
- Size
  
  1.1MB
- MD5
  
  d90b4dbea769da538ed3e81d35f5ac9e
- SHA1
  
  294b4c72e4c65660cb47e07b9409b91deb183da6
- SHA256
  
  e4742ef466dd828202db9a22bee89a4835b3e3600a202da218c42a44610a2bc0
- SHA512
  
  88513629125268e52075f5ecbff042999b6f870b4a1fe3a01f5e3a55bd99fca62323ea0e9c52d2cae15a6ee9d488afd56544655d7f7f5e6b06496169174f1844
- SSDEEP
  
  24576:eqDEvCTbMWu7rQYlBQcBiT6rprG8aoVEKLfAEo4Zcu+AsNw:eTvC/MTQYxsWR7aojAuY
Score

10^/10

agenttesla zgrat keylogger persistence rat spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Detect ZGRat V1
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslazgratkeyloggerpersistenceratspywarestealertrojan

behavioral2

agentteslazgratkeyloggerpersistenceratspywarestealertrojan

© 2018-2024

Terms | Privacy