Overview

overview

10

Static

static

5

c2d7e4045a...f4.exe

windows7-x64

10

c2d7e4045a...f4.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c2d7e4045a4e35ff3dbe6827f3b1106e1bb8d4abddab0b4ecafec5c0fd8426f4

  • Size

    1.1MB

  • Sample

    240509-bqny2sae2v

  • MD5

    1b34c3a7c7b5f64f0ab408ed803a5ab5

  • SHA1

    d4041a269eca52d005eaba374c6cbafe0fc31300

  • SHA256

    c2d7e4045a4e35ff3dbe6827f3b1106e1bb8d4abddab0b4ecafec5c0fd8426f4

  • SHA512

    e537b40dd12169d6cef0cf42b2919034827958edc38c68f5aba8e3e26dfaeb6dbd9ad2609186e24587512af7e2c304b65caecf656edf4eb904d821abaf5398e5

  • SSDEEP

    24576:C4lavt0LkLL9IMixoEgeaSzpCEzpOlABG6q9MmCS:1kwkn9IMHeaSsdlAB9aPCS

Score
10/10
agentteslazgratkeyloggerratspywarestealertrojan

Malware Config

Targets

    • Target

      c2d7e4045a4e35ff3dbe6827f3b1106e1bb8d4abddab0b4ecafec5c0fd8426f4

    • Size

      1.1MB

    • MD5

      1b34c3a7c7b5f64f0ab408ed803a5ab5

    • SHA1

      d4041a269eca52d005eaba374c6cbafe0fc31300

    • SHA256

      c2d7e4045a4e35ff3dbe6827f3b1106e1bb8d4abddab0b4ecafec5c0fd8426f4

    • SHA512

      e537b40dd12169d6cef0cf42b2919034827958edc38c68f5aba8e3e26dfaeb6dbd9ad2609186e24587512af7e2c304b65caecf656edf4eb904d821abaf5398e5

    • SSDEEP

      24576:C4lavt0LkLL9IMixoEgeaSzpCEzpOlABG6q9MmCS:1kwkn9IMHeaSsdlAB9aPCS

    Score
    10/10
    agentteslazgratkeyloggerratspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks