Overview

overview

10

Static

static

7

LPO.exe

windows7-x64

10

LPO.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3a795afc5fc1b74df84201208881753243596f0dec3b5ebd7ced7c350705ccdb

  • Size

    660KB

  • Sample

    240510-cjcswacf4z

  • MD5

    799bf9d121c0a2257917fe60258464fd

  • SHA1

    36b77a64136463937dc3638ef385035fac0b6cca

  • SHA256

    3a795afc5fc1b74df84201208881753243596f0dec3b5ebd7ced7c350705ccdb

  • SHA512

    0e348d2a3084e6c7565c38a842fa6c5a8c0197144d40186afd64058dd7a1f1e794a85963d1b86eda4f84bf8e296901a152e2e80a7f4f92f345397346c115c0ba

  • SSDEEP

    12288:jj1NdCWLNjPHUUPVoHmz1EzItKJW0186Ia1jW22Nn8AdVCDi4iX/:jDdtNzPV1oqKJ4hCjWRNntSi4iX/

Score
10/10
agentteslazgratkeyloggerratspywarestealertrojanupx

Malware Config

Targets

    • Target

      LPO.exe

    • Size

      685KB

    • MD5

      fbcef5c1f75e7bfe82c1e79333c298c4

    • SHA1

      26452a8f6e82b129478fa85886c8b8e1c95b7abd

    • SHA256

      2615de3ee09694dd7b8a639d0af2a46f79a4dbecf0d7ccd6d3df6aef797c3b8c

    • SHA512

      e21a5d1c4f8ea6b897f9c481722205867eb2656bd649278e32a86732f6398068181c8a5ed2b124dc49b45e1ffc86b781411f28ac8b23c6cf4db561aee69c488d

    • SSDEEP

      12288:2Xe9PPlowWX0t6mOQwg1Qd15CcYk0We1FA3PItKJW0X8SI+1ZW22NnmAdVMDi4i5:LhloDX0XOf40qKJG52ZWRNnrwi4iXp

    Score
    10/10
    agentteslazgratkeyloggerratspywarestealertrojanupx

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks