Overview

overview

10

Static

static

5

55ef7668db...4f.exe

windows7-x64

10

55ef7668db...4f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    55ef7668db1510c5c62979a247e9473962ffee441b6c34579c1ca4aee1ae894f

  • Size

    1.1MB

  • Sample

    240512-bypwbadb63

  • MD5

    7e2e4be9954534c726a8cadffec10ac6

  • SHA1

    bc33e4e0ffab747e7de429b21895e6c1af45a01b

  • SHA256

    55ef7668db1510c5c62979a247e9473962ffee441b6c34579c1ca4aee1ae894f

  • SHA512

    a451ab24b1527fda77ee01336797acdc948124218eb2f1e74cb72fbc65764782fb5c1a939cbc01beccb1ee92c663e403a1c8913d7603799d0298a0d866472b92

  • SSDEEP

    24576:l4lavt0LkLL9IMixoEgea5LTONsmImJbQcUIrq9MmCS:8kwkn9IMHea5LCCmImJlUOaPCS

Score
10/10
agentteslazgratkeyloggerpersistenceratspywarestealertrojan

Malware Config

Targets

    • Target

      55ef7668db1510c5c62979a247e9473962ffee441b6c34579c1ca4aee1ae894f

    • Size

      1.1MB

    • MD5

      7e2e4be9954534c726a8cadffec10ac6

    • SHA1

      bc33e4e0ffab747e7de429b21895e6c1af45a01b

    • SHA256

      55ef7668db1510c5c62979a247e9473962ffee441b6c34579c1ca4aee1ae894f

    • SHA512

      a451ab24b1527fda77ee01336797acdc948124218eb2f1e74cb72fbc65764782fb5c1a939cbc01beccb1ee92c663e403a1c8913d7603799d0298a0d866472b92

    • SSDEEP

      24576:l4lavt0LkLL9IMixoEgea5LTONsmImJbQcUIrq9MmCS:8kwkn9IMHea5LCCmImJlUOaPCS

    Score
    10/10
    agentteslazgratkeyloggerpersistenceratspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks