Overview

overview

10

Static

static

deb1926fff...fe.exe

windows7_x64

10

deb1926fff...fe.exe

windows10-2004_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    deb1926fff37ea682f311b0a63f11822a632964ff46d3afa51d6ce4ed445ecfe

  • Size

    1.1MB

  • Sample

    220520-2qkjqsaggr

  • MD5

    d9780b67ba2a096ef7618387efff3a09

  • SHA1

    2f476873f5f024173f1bc469c9778848c4860ec0

  • SHA256

    deb1926fff37ea682f311b0a63f11822a632964ff46d3afa51d6ce4ed445ecfe

  • SHA512

    01ce2810b76f438d8235ea90a633a8ee4f07d6e3f1a4d4e49e9620fc0be403eacf8a0be0d5ccbd5a879c788780052f6025a59f6a1b70f4a4bf0a0f5534cc6c17

Score
10/10
agentteslacollectionkeyloggerpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      deb1926fff37ea682f311b0a63f11822a632964ff46d3afa51d6ce4ed445ecfe

    • Size

      1.1MB

    • MD5

      d9780b67ba2a096ef7618387efff3a09

    • SHA1

      2f476873f5f024173f1bc469c9778848c4860ec0

    • SHA256

      deb1926fff37ea682f311b0a63f11822a632964ff46d3afa51d6ce4ed445ecfe

    • SHA512

      01ce2810b76f438d8235ea90a633a8ee4f07d6e3f1a4d4e49e9620fc0be403eacf8a0be0d5ccbd5a879c788780052f6025a59f6a1b70f4a4bf0a0f5534cc6c17

    Score
    10/10
    agentteslacollectionkeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks