Overview

overview

10

Static

static

5

27ea6655cc...3e.exe

windows7-x64

10

27ea6655cc...3e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    27ea6655cc7fc86d945b3b4fb3a552152d52d5a0bbef1bae743fc9e4cac97b3e

  • Size

    1.2MB

  • Sample

    240507-b3yn1scg21

  • MD5

    e4fd60fd28fd5b3a169fb723a669bb00

  • SHA1

    cd200b326dfcda10b965b46b732dc5b91d6c4cb0

  • SHA256

    27ea6655cc7fc86d945b3b4fb3a552152d52d5a0bbef1bae743fc9e4cac97b3e

  • SHA512

    3074b377e1312e1fc4a06b70e1bfac7a7d15f278bca1f537a59d0f6dbe7d74c154fcc173462124f4c35c92d416ba5f973355754b77848a7bee8bd4a9d359ba30

  • SSDEEP

    24576:JqDEvCTbMWu7rQYlBQcBiT6rprG8akqfYcaPP/UmA6/ISnkR2:JTvC/MTQYxsWR7akqfYc0UmA6Vn4

Score
10/10
agentteslazgratkeyloggerratspywarestealertrojan

Malware Config

Targets

    • Target

      27ea6655cc7fc86d945b3b4fb3a552152d52d5a0bbef1bae743fc9e4cac97b3e

    • Size

      1.2MB

    • MD5

      e4fd60fd28fd5b3a169fb723a669bb00

    • SHA1

      cd200b326dfcda10b965b46b732dc5b91d6c4cb0

    • SHA256

      27ea6655cc7fc86d945b3b4fb3a552152d52d5a0bbef1bae743fc9e4cac97b3e

    • SHA512

      3074b377e1312e1fc4a06b70e1bfac7a7d15f278bca1f537a59d0f6dbe7d74c154fcc173462124f4c35c92d416ba5f973355754b77848a7bee8bd4a9d359ba30

    • SSDEEP

      24576:JqDEvCTbMWu7rQYlBQcBiT6rprG8akqfYcaPP/UmA6/ISnkR2:JTvC/MTQYxsWR7akqfYc0UmA6Vn4

    Score
    10/10
    agentteslazgratkeyloggerratspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks