Overview

overview

10

Static

static

5

cb6916b0fb...32.exe

windows7-x64

10

cb6916b0fb...32.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cb6916b0fb40cdf6c0af7610b9347c22a5fef336f70e93fda8fd05e4b3baab32

  • Size

    1.1MB

  • Sample

    240507-bryjwaca8x

  • MD5

    9cacbd63180f26c72fbbf75cf241eb35

  • SHA1

    73e6d3e7763f4e4b2d5d938f035bf26531f8c97f

  • SHA256

    cb6916b0fb40cdf6c0af7610b9347c22a5fef336f70e93fda8fd05e4b3baab32

  • SHA512

    7a425e0f291e47797842dd485ffce706a5c776085030430ecf8bbbda36c256c4860c79eafcb82dd1c8a9babf09d0fbf5a3e02e90e2782ad44300a0a03a59e644

  • SSDEEP

    24576:SqDEvCTbMWu7rQYlBQcBiT6rprG8atH0PWxDbOFP1BNQI:STvC/MTQYxsWR7atH+WclDy

Score
10/10
agentteslazgratkeyloggerpersistenceratspywarestealertrojan

Malware Config

Targets

    • Target

      cb6916b0fb40cdf6c0af7610b9347c22a5fef336f70e93fda8fd05e4b3baab32

    • Size

      1.1MB

    • MD5

      9cacbd63180f26c72fbbf75cf241eb35

    • SHA1

      73e6d3e7763f4e4b2d5d938f035bf26531f8c97f

    • SHA256

      cb6916b0fb40cdf6c0af7610b9347c22a5fef336f70e93fda8fd05e4b3baab32

    • SHA512

      7a425e0f291e47797842dd485ffce706a5c776085030430ecf8bbbda36c256c4860c79eafcb82dd1c8a9babf09d0fbf5a3e02e90e2782ad44300a0a03a59e644

    • SSDEEP

      24576:SqDEvCTbMWu7rQYlBQcBiT6rprG8atH0PWxDbOFP1BNQI:STvC/MTQYxsWR7atH+WclDy

    Score
    10/10
    agentteslazgratkeyloggerpersistenceratspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Adds Run key to start application

      persistence

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks