Overview

overview

10

Static

static

3

EXJ-CHPV-0...01.exe

windows7-x64

10

EXJ-CHPV-0...01.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e709e4b36a75347f128678da33353713f2bf7a56cf3a84275e8e1679f2f3adbe

  • Size

    693KB

  • Sample

    240507-bf4lraed27

  • MD5

    28cf4c99c9cc19d6d8ba690b1bfbd828

  • SHA1

    9373b4cc3f14565181f46ef147b43219f3aa6e99

  • SHA256

    e709e4b36a75347f128678da33353713f2bf7a56cf3a84275e8e1679f2f3adbe

  • SHA512

    92b3adab9cea50fa921771a3e48385d7f9ce69ff8e313dec1f36157e87464e4c7d02124bac7f29821ff78b14f018f8d4a342c06dd5af62abd99e30e90d04d303

  • SSDEEP

    12288:x96/ZgC/Y1HZX4TIaLRbP+/5qpRKn9x0QW0fZN8KS9a3pnvzDbFybbSM:+/YFZojbPGKKb0QW0fZN7S9apHESM

Score
10/10
agentteslazgratkeyloggerpersistenceratspywarestealertrojan

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.strato.de
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Oy1)8JSu_qPx(rzV_{Xu

Targets

    • Target

      EXJ-CHPV-05-N01-001.exe

    • Size

      767KB

    • MD5

      57d4e5602ac60212f7c422321c9b0b80

    • SHA1

      a6d42a59f9d8121cfaab73f4b2b416e229fbafcd

    • SHA256

      8a2fc6d9e2cc5549bc52b8914be340fbd0f72ae63d6f8b7959d1854342767e26

    • SHA512

      b725661cbd3d35d889289fb86a3ca2a6355768cd35e047ff82f64c7717759703c24af2f2ee7bc31f50af3fc073fe9a1dee560d71305f180a2cb56676021aeed0

    • SSDEEP

      12288:BLS6MKtR/ZZ4xYalDPn+v1spR4R9xSQkyRZNQKMza1Nn9zD7N+bd0/:pS6MkR/ZytPnIY2bSQkyRZNXMzeN1o0/

    Score
    10/10
    agentteslazgratkeyloggerpersistenceratspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks