Overview

overview

10

Static

static

5

3d8d590eb6...e1.exe

windows7-x64

10

3d8d590eb6...e1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3d8d590eb69f7b562682d0f1b92cfa97783a755905b77a2caa13f8a35b812fe1

  • Size

    1.1MB

  • Sample

    240512-bs51cahh9t

  • MD5

    bf23f533566c4feeefa524c8be31e1eb

  • SHA1

    16a981f9321cfbdd236cfad678aeb62c2665f639

  • SHA256

    3d8d590eb69f7b562682d0f1b92cfa97783a755905b77a2caa13f8a35b812fe1

  • SHA512

    ba84e42fd8eec9eeed37601d748bed0b3f42c5557ff8d8640946b9e5b9228280065df9ff2420ac4fbd8168fce40d3cad4d587f8b318643190d3af92f2f5e86c3

  • SSDEEP

    24576:BAHnh+eWsN3skA4RV1Hom2KXMmHazeQNriQD0zna0sH5:Yh+ZkldoPK8Yaz9N7D0Vc

Score
10/10
agentteslazgratkeyloggerratspywarestealertrojan

Malware Config

Targets

    • Target

      3d8d590eb69f7b562682d0f1b92cfa97783a755905b77a2caa13f8a35b812fe1

    • Size

      1.1MB

    • MD5

      bf23f533566c4feeefa524c8be31e1eb

    • SHA1

      16a981f9321cfbdd236cfad678aeb62c2665f639

    • SHA256

      3d8d590eb69f7b562682d0f1b92cfa97783a755905b77a2caa13f8a35b812fe1

    • SHA512

      ba84e42fd8eec9eeed37601d748bed0b3f42c5557ff8d8640946b9e5b9228280065df9ff2420ac4fbd8168fce40d3cad4d587f8b318643190d3af92f2f5e86c3

    • SSDEEP

      24576:BAHnh+eWsN3skA4RV1Hom2KXMmHazeQNriQD0zna0sH5:Yh+ZkldoPK8Yaz9N7D0Vc

    Score
    10/10
    agentteslazgratkeyloggerratspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks