Overview

overview

10

Static

static

3

CheatoSpoofer.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    CheatoSpoofer.exe

  • Size

    31.7MB

  • Sample

    240509-ppn5bahf2y

  • MD5

    d55cc4db0fc8dbffe183f78205ec03fa

  • SHA1

    f02664f6276a1b88ecb14efb4e7c7d9b0747c7d6

  • SHA256

    a3c5ad53ca0367b79c56cb0dc0c42484b9a4e7fa77290ca6ec233f94cacf1e8b

  • SHA512

    b26aaae019111d5e23fb293de30380646770dcd31e146edfaff37904f5dc78ac2504050d647d4f212ad42f14a9193a7dc6ef7171f30f356b023fd129e94ec251

  • SSDEEP

    786432:0lH0ByeGkm9QxG774aXrKE/Awx7PL/PlTe0P98qtyXU:s6yesGWnbK5EPL/PlCk60q

Score
10/10
agentteslazgratagilenetkeyloggerratspywarestealertrojan

Malware Config

Targets

    • Target

      CheatoSpoofer.exe

    • Size

      31.7MB

    • MD5

      d55cc4db0fc8dbffe183f78205ec03fa

    • SHA1

      f02664f6276a1b88ecb14efb4e7c7d9b0747c7d6

    • SHA256

      a3c5ad53ca0367b79c56cb0dc0c42484b9a4e7fa77290ca6ec233f94cacf1e8b

    • SHA512

      b26aaae019111d5e23fb293de30380646770dcd31e146edfaff37904f5dc78ac2504050d647d4f212ad42f14a9193a7dc6ef7171f30f356b023fd129e94ec251

    • SSDEEP

      786432:0lH0ByeGkm9QxG774aXrKE/Awx7PL/PlTe0P98qtyXU:s6yesGWnbK5EPL/PlCk60q

    Score
    10/10
    agentteslazgratagilenetkeyloggerratspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • AgentTesla payload

    • Loads dropped DLL

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks