Overview

overview

10

Static

static

MT051461000.exe

windows7-x64

10

MT051461000.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    MT051461000.exe

  • Size

    1.1MB

  • Sample

    221020-rzgt4ahffm

  • MD5

    982bf0d7cd9ed233d690d9be910fe71b

  • SHA1

    659474bbcd064baae334ab0822a2d9d50c1e4cbe

  • SHA256

    756a3c2f40c9dd5b589583c83f4e1222c78c72ed92fd0f73858ccb7b6c0831dd

  • SHA512

    4ff5df70e6cdbfdfcce628bb81b44ab8c0258dc783caaa8a213829e04d3799f250c92e674966b5b7bd98a18c5046f76b5069351170e0993d1fb9d91fff802012

  • SSDEEP

    24576:pAOcZT+5HGNmmX2I93GjB1aCZ73QqQ5SOb2eYzc0r:DRGN3X2sQBbJNzca

Score
10/10
agentteslacollectionkeyloggerpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      MT051461000.exe

    • Size

      1.1MB

    • MD5

      982bf0d7cd9ed233d690d9be910fe71b

    • SHA1

      659474bbcd064baae334ab0822a2d9d50c1e4cbe

    • SHA256

      756a3c2f40c9dd5b589583c83f4e1222c78c72ed92fd0f73858ccb7b6c0831dd

    • SHA512

      4ff5df70e6cdbfdfcce628bb81b44ab8c0258dc783caaa8a213829e04d3799f250c92e674966b5b7bd98a18c5046f76b5069351170e0993d1fb9d91fff802012

    • SSDEEP

      24576:pAOcZT+5HGNmmX2I93GjB1aCZ73QqQ5SOb2eYzc0r:DRGN3X2sQBbJNzca

    Score
    10/10
    agentteslakeyloggerpersistencespywarestealertrojancollection

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks