agenttesla | be8aa532f4b1be1dde4deb2c68aa68a8522e5d9ec72d218ab59df0c086663dba | Triage

Submit
Reports

Overview

overview

Static

static

5

be8aa532f4...ba.exe

windows7-x64

be8aa532f4...ba.exe

windows10-2004-x64

Sharing

General

Target

be8aa532f4b1be1dde4deb2c68aa68a8522e5d9ec72d218ab59df0c086663dba
Size

1.1MB
Sample

240506-bgmpmabh5y
MD5

4a67da73fe59354e3f45bdd7f9da4514
SHA1

2d2fbb7c8161870f32088e120fd45bcfc5add251
SHA256

be8aa532f4b1be1dde4deb2c68aa68a8522e5d9ec72d218ab59df0c086663dba
SHA512

5a5b59ba9e17fdc9865fa868d0fcbfa7dd94b80affd596a7689ef39c7577ab101c856db7f52a2e3c644af3cbdb90b249566b5666a5761c4863de890256bbba69
SSDEEP

24576:8qDEvCTbMWu7rQYlBQcBiT6rprG8a/O6+LIjcLqCiV81tNH:8TvC/MTQYxsWR7a/eLqCke

Score

10^/10

agenttesla zgrat keylogger persistence rat spyware stealer trojan

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

be8aa532f4b1be1dde4deb2c68aa68a8522e5d9ec72d218ab59df0c086663dba.exe

Resource

win7-20240221-en

agenttesla zgrat keylogger persistence rat spyware stealer trojan

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

be8aa532f4b1be1dde4deb2c68aa68a8522e5d9ec72d218ab59df0c086663dba.exe

Resource

win10v2004-20240419-en

agenttesla zgrat keylogger persistence rat spyware stealer trojan

windows10-2004-x64

13 signatures

150 seconds

Malware Config

Targets

- Target
  
  be8aa532f4b1be1dde4deb2c68aa68a8522e5d9ec72d218ab59df0c086663dba
- Size
  
  1.1MB
- MD5
  
  4a67da73fe59354e3f45bdd7f9da4514
- SHA1
  
  2d2fbb7c8161870f32088e120fd45bcfc5add251
- SHA256
  
  be8aa532f4b1be1dde4deb2c68aa68a8522e5d9ec72d218ab59df0c086663dba
- SHA512
  
  5a5b59ba9e17fdc9865fa868d0fcbfa7dd94b80affd596a7689ef39c7577ab101c856db7f52a2e3c644af3cbdb90b249566b5666a5761c4863de890256bbba69
- SSDEEP
  
  24576:8qDEvCTbMWu7rQYlBQcBiT6rprG8a/O6+LIjcLqCiV81tNH:8TvC/MTQYxsWR7a/eLqCke
Score

10^/10

agenttesla zgrat keylogger persistence rat spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Detect ZGRat V1
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

agentteslazgratkeyloggerpersistenceratspywarestealertrojan

behavioral2

agentteslazgratkeyloggerpersistenceratspywarestealertrojan

© 2018-2025

Terms | Privacy