agenttesla

General

Target

a32dfbcd2abf95986dd76e45a14ffa964047e6622022a337b8d81421fda737b0.exe
Size

1.1MB
Sample

240501-b91f7adc51
MD5

db6995dd887f74cecf421f4c57276b1c
SHA1

149a20a0721c46191c342df174bca82930c09058
SHA256

a32dfbcd2abf95986dd76e45a14ffa964047e6622022a337b8d81421fda737b0
SHA512

b4c2a1a87b2132de3b771797191703a9549500f9d228226c916f643c1f5dfb83da16707edb2b8720971cf62c3b0d229d577b907a5b32818ca04f2be70f77551b
SSDEEP

24576:dqDEvCTbMWu7rQYlBQcBiT6rprG8aFPIoOTdUoLAfENA:dTvC/MTQYxsWR7aFwoOBUocE

Score

10^/10

Malware Config

Targets

- Target
  
  a32dfbcd2abf95986dd76e45a14ffa964047e6622022a337b8d81421fda737b0.exe
- Size
  
  1.1MB
- MD5
  
  db6995dd887f74cecf421f4c57276b1c
- SHA1
  
  149a20a0721c46191c342df174bca82930c09058
- SHA256
  
  a32dfbcd2abf95986dd76e45a14ffa964047e6622022a337b8d81421fda737b0
- SHA512
  
  b4c2a1a87b2132de3b771797191703a9549500f9d228226c916f643c1f5dfb83da16707edb2b8720971cf62c3b0d229d577b907a5b32818ca04f2be70f77551b
- SSDEEP
  
  24576:dqDEvCTbMWu7rQYlBQcBiT6rprG8aFPIoOTdUoLAfENA:dTvC/MTQYxsWR7aFwoOBUocE
Score

10^/10

agenttesla zgrat keylogger persistence rat spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Detect ZGRat V1
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Detect packed .NET executables. Mostly AgentTeslaV4.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
- Detects executables referencing Windows vault credential objects. Observed in infostealers
- Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
- Detects executables referencing many email and collaboration clients. Observed in information stealers
- Detects executables referencing many file transfer clients. Observed in information stealers
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2