Overview

overview

10

Static

static

PAYMENT COPY.exe

windows7-x64

10

PAYMENT COPY.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PAYMENT COPY.exe

  • Size

    510KB

  • Sample

    221123-splwqseh9w

  • MD5

    1a245500e0696bb8d89aebd5acd1bee1

  • SHA1

    dda56b8b97574caa956abb1eb291c4cafda92ba3

  • SHA256

    9c9334c90a2e559eed3e8fc03ab85709ab00394cc4c0f12bd481d70f30d3171b

  • SHA512

    c56e71284858fde376245d8d4a990be276249ba7eade3d27d71f7a5a2cccb6464a26b67abcee4eaa39bb43356f3a4d401a6f6b882653bbbc2d968703bde093be

  • SSDEEP

    12288:ojrABfUnI3ZUlSrz4B9nsCm2XEx4TzsDij:ojruUcbrE9nsCm20xb

Score
10/10
agentteslacollectionkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      PAYMENT COPY.exe

    • Size

      510KB

    • MD5

      1a245500e0696bb8d89aebd5acd1bee1

    • SHA1

      dda56b8b97574caa956abb1eb291c4cafda92ba3

    • SHA256

      9c9334c90a2e559eed3e8fc03ab85709ab00394cc4c0f12bd481d70f30d3171b

    • SHA512

      c56e71284858fde376245d8d4a990be276249ba7eade3d27d71f7a5a2cccb6464a26b67abcee4eaa39bb43356f3a4d401a6f6b882653bbbc2d968703bde093be

    • SSDEEP

      12288:ojrABfUnI3ZUlSrz4B9nsCm2XEx4TzsDij:ojruUcbrE9nsCm20xb

    Score
    10/10
    agentteslacollectionkeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks