Overview

overview

10

Static

static

7

180896df7d...23.exe

windows7-x64

10

180896df7d...23.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    180896df7dc93c43d3da245c9f40c20f10902bc4d1a8b38386ec1ce185e71123

  • Size

    702KB

  • Sample

    240427-b36pmagd78

  • MD5

    73cf576f8b9052985b473488a5b4816a

  • SHA1

    75aeec0ab7a8cd10e487df65a988d1b9b13475a3

  • SHA256

    180896df7dc93c43d3da245c9f40c20f10902bc4d1a8b38386ec1ce185e71123

  • SHA512

    d911fd9efb3611b450a646cb3979ba5f8ae682ce9e2e96296cdf4ecdbf5aa618d9094cd4c2312d961c507294e7e9e9bd4568c15ee1161c9e34409c1cc22e191d

  • SSDEEP

    12288:msHzOUNUSB/o5LsI1uwajJ5yvv1l2RjmrLmxGi7qidkiKz3PeLk/NYZC6Nhe:JiUmSB/o5d1ubcvGxFqAmz3PmkGk6Nhe

Score
10/10
agentteslazgratkeyloggerratspywarestealertrojanupx

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      180896df7dc93c43d3da245c9f40c20f10902bc4d1a8b38386ec1ce185e71123

    • Size

      702KB

    • MD5

      73cf576f8b9052985b473488a5b4816a

    • SHA1

      75aeec0ab7a8cd10e487df65a988d1b9b13475a3

    • SHA256

      180896df7dc93c43d3da245c9f40c20f10902bc4d1a8b38386ec1ce185e71123

    • SHA512

      d911fd9efb3611b450a646cb3979ba5f8ae682ce9e2e96296cdf4ecdbf5aa618d9094cd4c2312d961c507294e7e9e9bd4568c15ee1161c9e34409c1cc22e191d

    • SSDEEP

      12288:msHzOUNUSB/o5LsI1uwajJ5yvv1l2RjmrLmxGi7qidkiKz3PeLk/NYZC6Nhe:JiUmSB/o5d1ubcvGxFqAmz3PmkGk6Nhe

    Score
    10/10
    agentteslazgratkeyloggerratspywarestealertrojanupx

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks