Overview

overview

10

Static

static

5

514433b538...e9.exe

windows7-x64

10

514433b538...e9.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    514433b53820eeae8c05a3e2c370b68cd9dfbaebd74faf1cb7a0c5f5eb12b2e9

  • Size

    1.1MB

  • Sample

    240512-byx7padb74

  • MD5

    58e6e98b5e2f780b7f58d300f9db695f

  • SHA1

    12afe23b1327c8c32067e6e10524cea1343f5492

  • SHA256

    514433b53820eeae8c05a3e2c370b68cd9dfbaebd74faf1cb7a0c5f5eb12b2e9

  • SHA512

    d363f0e70dd1423fbc59c974f631ea531275f439ea5c040cf9b49fc764ccd554c32cf17bba86e31946a5ef184663aa6fd32a3aed42591c5337a29b30d31518fc

  • SSDEEP

    24576:q4lavt0LkLL9IMixoEgeanWYqAOl8+vblnNhq9MmCS:9kwkn9IMHeanWRq+jVbaPCS

Score
10/10
agentteslazgratkeyloggerratspywarestealertrojan

Malware Config

Targets

    • Target

      514433b53820eeae8c05a3e2c370b68cd9dfbaebd74faf1cb7a0c5f5eb12b2e9

    • Size

      1.1MB

    • MD5

      58e6e98b5e2f780b7f58d300f9db695f

    • SHA1

      12afe23b1327c8c32067e6e10524cea1343f5492

    • SHA256

      514433b53820eeae8c05a3e2c370b68cd9dfbaebd74faf1cb7a0c5f5eb12b2e9

    • SHA512

      d363f0e70dd1423fbc59c974f631ea531275f439ea5c040cf9b49fc764ccd554c32cf17bba86e31946a5ef184663aa6fd32a3aed42591c5337a29b30d31518fc

    • SSDEEP

      24576:q4lavt0LkLL9IMixoEgeanWYqAOl8+vblnNhq9MmCS:9kwkn9IMHeanWRq+jVbaPCS

    Score
    10/10
    agentteslazgratkeyloggerratspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks