agenttesla

General

Target

2bb91cb12d94dfc4ed8874b825ce50d70b049ce989b01b0991e75d30ae24f480
Size

2.2MB
Sample

240430-bw478agh4s
MD5

b9eb55d6232f4f4ff2e5a11d23c668a3
SHA1

36c6f4dc1df713d587ca033c1f9ca12cf76fc771
SHA256

2bb91cb12d94dfc4ed8874b825ce50d70b049ce989b01b0991e75d30ae24f480
SHA512

c4170eaa71c666f76ddbbcbc55026ac38464df5566ac4528b5cc6cc7334548a832bcf62bad1cf05682351d01a6ef349af9141d3afd27aeb64494e5e491230ce6
SSDEEP

49152:g8zUcHrw7FvJJD+FXkUru1lyA6bk7cjpmYBA3F4sEOPlVufPA5J/d232M:Fxrw71O4lNEkIjpBAWe4fPQA2

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.gencoldfire.com
Port:
587
Username:
[email protected]
Password:
mh7B/7[hSO#bYHw1
Email To:
[email protected]

Extracted

Credentials

Protocol: smtp
Host:
mail.gencoldfire.com
Port:
587
Username:
[email protected]
Password:
mh7B/7[hSO#bYHw1

Targets

- Target
  
  2bb91cb12d94dfc4ed8874b825ce50d70b049ce989b01b0991e75d30ae24f480
- Size
  
  2.2MB
- MD5
  
  b9eb55d6232f4f4ff2e5a11d23c668a3
- SHA1
  
  36c6f4dc1df713d587ca033c1f9ca12cf76fc771
- SHA256
  
  2bb91cb12d94dfc4ed8874b825ce50d70b049ce989b01b0991e75d30ae24f480
- SHA512
  
  c4170eaa71c666f76ddbbcbc55026ac38464df5566ac4528b5cc6cc7334548a832bcf62bad1cf05682351d01a6ef349af9141d3afd27aeb64494e5e491230ce6
- SSDEEP
  
  49152:g8zUcHrw7FvJJD+FXkUru1lyA6bk7cjpmYBA3F4sEOPlVufPA5J/d232M:Fxrw71O4lNEkIjpBAWe4fPQA2
Score

10^/10

agenttesla zgrat keylogger rat spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Detect ZGRat V1
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

4

T1552

Credentials In Files

3

T1552.001

Credentials in Registry

1

T1552.002

Discovery

Lateral Movement

Collection

Data from Local System

4

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Detect ZGRat V1

ZGRat

Reads WinSCP keys stored on the system

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2