Overview

overview

10

Static

static

8DL3LHg4SB6Q7z2.exe

windows7_x64

10

8DL3LHg4SB6Q7z2.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8DL3LHg4SB6Q7z2.exe

  • Size

    598KB

  • Sample

    210511-a94eamr7rs

  • MD5

    4212c79d57ff6347883dbc23d4f3846d

  • SHA1

    17cc7ba6332e18a8572a82ab4bc1e039d791d308

  • SHA256

    113c1364bffb0f75376c6728d53bc47304fd8f8077dc0765f1b924f04d5456e8

  • SHA512

    c97f56f6a9373cb2b0dcaefddeedb2cf436847edf01fb35e7a020ae111aaa325a2ff192da0bd4787d943fa1ea32ae7ebafc4785ccce00f8fe9152ad23d34826e

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.privateemail.com
  • Port:
    587
  • Username:
    ken@kengrouco.xyz
  • Password:
    Everest10

Targets

    • Target

      8DL3LHg4SB6Q7z2.exe

    • Size

      598KB

    • MD5

      4212c79d57ff6347883dbc23d4f3846d

    • SHA1

      17cc7ba6332e18a8572a82ab4bc1e039d791d308

    • SHA256

      113c1364bffb0f75376c6728d53bc47304fd8f8077dc0765f1b924f04d5456e8

    • SHA512

      c97f56f6a9373cb2b0dcaefddeedb2cf436847edf01fb35e7a020ae111aaa325a2ff192da0bd4787d943fa1ea32ae7ebafc4785ccce00f8fe9152ad23d34826e

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • Drops file in Drivers directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks