Overview

overview

10

Static

static

5

d89996c1e3...eb.exe

windows7-x64

10

d89996c1e3...eb.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d89996c1e3cd59f959934b14e930277f5434a5c1e667990de94c1e4cb2f243eb

  • Size

    1.1MB

  • Sample

    240430-ce738ahb94

  • MD5

    67e9c69943cca3c70450366e16f19d5c

  • SHA1

    5ed01d66f03554f7df9022d53b99a5a26a835d69

  • SHA256

    d89996c1e3cd59f959934b14e930277f5434a5c1e667990de94c1e4cb2f243eb

  • SHA512

    9d7701c7767385c24e2a8d33dce07be249b7d68fdd6f8cb9e3491c3e6f93aa51022d7d62487f7bd704f03c2813f2a28dc9f1cbdf5c805494babf9ec9208fe5ce

  • SSDEEP

    24576:FAHnh+eWsN3skA4RV1Hom2KXMmHamTHSffZ/CYrV5:0h+ZkldoPK8YamzSffZL

Score
10/10
agentteslazgratkeyloggerratspywarestealertrojan

Malware Config

Targets

    • Target

      d89996c1e3cd59f959934b14e930277f5434a5c1e667990de94c1e4cb2f243eb

    • Size

      1.1MB

    • MD5

      67e9c69943cca3c70450366e16f19d5c

    • SHA1

      5ed01d66f03554f7df9022d53b99a5a26a835d69

    • SHA256

      d89996c1e3cd59f959934b14e930277f5434a5c1e667990de94c1e4cb2f243eb

    • SHA512

      9d7701c7767385c24e2a8d33dce07be249b7d68fdd6f8cb9e3491c3e6f93aa51022d7d62487f7bd704f03c2813f2a28dc9f1cbdf5c805494babf9ec9208fe5ce

    • SSDEEP

      24576:FAHnh+eWsN3skA4RV1Hom2KXMmHamTHSffZ/CYrV5:0h+ZkldoPK8YamzSffZL

    Score
    10/10
    agentteslazgratkeyloggerratspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks