Overview

overview

10

Static

static

10

2ed87808d7...c7.exe

windows7-x64

10

2ed87808d7...c7.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2ed87808d7729badb747a0996fa2aa9c3a9410816589a3bc05fe8dc4471c6bc7

  • Size

    304KB

  • Sample

    240515-bnmm7sad59

  • MD5

    0fa72865d9fff7b017cb1b43db3758f0

  • SHA1

    441a875f77f7072752dba42b37e5674a6da6eca1

  • SHA256

    2ed87808d7729badb747a0996fa2aa9c3a9410816589a3bc05fe8dc4471c6bc7

  • SHA512

    3343a8b71dab912d913b5a7204f0f1410dae662a50de9ee65a6d6feb8b303c65836388840dcd659e80e3de55236a16fe3ef207926f2f6014f1096378421bcc1c

  • SSDEEP

    6144:93HDamaOKhRXYZZfwdBvn5rNRGlXew3KVfu:9jamaOKhRww9NIo2KF

Score
10/10
agentteslazgratkeyloggerratspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      2ed87808d7729badb747a0996fa2aa9c3a9410816589a3bc05fe8dc4471c6bc7

    • Size

      304KB

    • MD5

      0fa72865d9fff7b017cb1b43db3758f0

    • SHA1

      441a875f77f7072752dba42b37e5674a6da6eca1

    • SHA256

      2ed87808d7729badb747a0996fa2aa9c3a9410816589a3bc05fe8dc4471c6bc7

    • SHA512

      3343a8b71dab912d913b5a7204f0f1410dae662a50de9ee65a6d6feb8b303c65836388840dcd659e80e3de55236a16fe3ef207926f2f6014f1096378421bcc1c

    • SSDEEP

      6144:93HDamaOKhRXYZZfwdBvn5rNRGlXew3KVfu:9jamaOKhRww9NIo2KF

    Score
    10/10
    agentteslazgratkeyloggerratspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks