Overview

overview

10

Static

static

5

9cbd6f3535...6c.exe

windows7-x64

10

9cbd6f3535...6c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9cbd6f353523ae3df7bc1014ceeb7ba74c1805495f1842b921cd0d7797c10a6c.exe

  • Size

    1.1MB

  • Sample

    240514-bzcblsed77

  • MD5

    6a8b70dcb35732e43696553050e6c5bd

  • SHA1

    01cf1e4b74abf7a5674740737e075c0e83fde303

  • SHA256

    9cbd6f353523ae3df7bc1014ceeb7ba74c1805495f1842b921cd0d7797c10a6c

  • SHA512

    82b0f0207fd305d1d612c5e145c1f085258b7b910e7adea0d6e49b3c0207e7e1d33ac1e4e6ff6d588f400762794643816141d21a9325e4fed90b33acae54dc88

  • SSDEEP

    24576:NAHnh+eWsN3skA4RV1Hom2KXMmHa1SF8e04fPcFFHLayy5:sh+ZkldoPK8Ya1nj43cFFHLaj

Score
10/10
agentteslazgratkeyloggerratspywarestealertrojan

Malware Config

Targets

    • Target

      9cbd6f353523ae3df7bc1014ceeb7ba74c1805495f1842b921cd0d7797c10a6c.exe

    • Size

      1.1MB

    • MD5

      6a8b70dcb35732e43696553050e6c5bd

    • SHA1

      01cf1e4b74abf7a5674740737e075c0e83fde303

    • SHA256

      9cbd6f353523ae3df7bc1014ceeb7ba74c1805495f1842b921cd0d7797c10a6c

    • SHA512

      82b0f0207fd305d1d612c5e145c1f085258b7b910e7adea0d6e49b3c0207e7e1d33ac1e4e6ff6d588f400762794643816141d21a9325e4fed90b33acae54dc88

    • SSDEEP

      24576:NAHnh+eWsN3skA4RV1Hom2KXMmHa1SF8e04fPcFFHLayy5:sh+ZkldoPK8Ya1nj43cFFHLaj

    Score
    10/10
    agentteslazgratkeyloggerratspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Detect packed .NET executables. Mostly AgentTeslaV4.

    • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

    • Detects executables referencing Windows vault credential objects. Observed in infostealers

    • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

    • Detects executables referencing many email and collaboration clients. Observed in information stealers

    • Detects executables referencing many file transfer clients. Observed in information stealers

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks