General
-
Target
a2f706ab41a92d4fb767e26c7b1d710c165c59214456702be8bb2428d6d6236b.exe
-
Size
1.3MB
-
Sample
240509-cae7msbh7y
-
MD5
a5483caabc4d39093832411bfb71ca89
-
SHA1
d8e7fc4c53ce6227a57e2afea785a182067c93dd
-
SHA256
a2f706ab41a92d4fb767e26c7b1d710c165c59214456702be8bb2428d6d6236b
-
SHA512
88f759448adc4f7bf6c6e41f14c9d86c4b50af6280958e9eb4103058f71b4a7a82832c7bfbf4c6ae94f24f254ce536ed2ba63e14d46bea1d05dd249451c805ae
-
SSDEEP
24576:I4lavt0LkLL9IMixoEgeaiqssbe6fht/QpvOq9MmCS:fkwkn9IMHeaiq35t/ZaPCS
Malware Config
Targets
-
-
Target
a2f706ab41a92d4fb767e26c7b1d710c165c59214456702be8bb2428d6d6236b.exe
-
Size
1.3MB
-
MD5
a5483caabc4d39093832411bfb71ca89
-
SHA1
d8e7fc4c53ce6227a57e2afea785a182067c93dd
-
SHA256
a2f706ab41a92d4fb767e26c7b1d710c165c59214456702be8bb2428d6d6236b
-
SHA512
88f759448adc4f7bf6c6e41f14c9d86c4b50af6280958e9eb4103058f71b4a7a82832c7bfbf4c6ae94f24f254ce536ed2ba63e14d46bea1d05dd249451c805ae
-
SSDEEP
24576:I4lavt0LkLL9IMixoEgeaiqssbe6fht/QpvOq9MmCS:fkwkn9IMHeaiq35t/ZaPCS
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Detect packed .NET executables. Mostly AgentTeslaV4.
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
-
Detects executables referencing Windows vault credential objects. Observed in infostealers
-
Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
-
Detects executables referencing many email and collaboration clients. Observed in information stealers
-
Detects executables referencing many file transfer clients. Observed in information stealers
-
Suspicious use of SetThreadContext
-