Overview

overview

10

Static

static

10

CARPETA_.EXE.exe

windows7-x64

10

CARPETA_.EXE.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    CARPETA_.EXE.exe

  • Size

    834KB

  • Sample

    221125-jd4gzabc37

  • MD5

    97d2766b203cad5490aeae4049823b5c

  • SHA1

    a2559089ca598289ad964bb3aa63456c0ab8b4fd

  • SHA256

    31f9e178c2015a364ea2035c77eb27f1b40165648900f824945d548e93885716

  • SHA512

    0733d5e248d71e1c385c7c08b83474a90112c0326d3dcadb8d7b68d3c0eaa33c294012e4462fc37a875f3cd64ae727ba558fd3ebed132784525b8802eed1b65c

  • SSDEEP

    12288:Ly2OoPnK3jbgtwPi5CdZV7e8M4iULTXHYHmBE6mHtP38M:Qa/

Score
10/10
agentteslaneshtacollectionkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot5678941731:AAHuT6ry1HeTpvo1csjgif_TAWF-WtH0QZk/

Targets

    • Target

      CARPETA_.EXE.exe

    • Size

      834KB

    • MD5

      97d2766b203cad5490aeae4049823b5c

    • SHA1

      a2559089ca598289ad964bb3aa63456c0ab8b4fd

    • SHA256

      31f9e178c2015a364ea2035c77eb27f1b40165648900f824945d548e93885716

    • SHA512

      0733d5e248d71e1c385c7c08b83474a90112c0326d3dcadb8d7b68d3c0eaa33c294012e4462fc37a875f3cd64ae727ba558fd3ebed132784525b8802eed1b65c

    • SSDEEP

      12288:Ly2OoPnK3jbgtwPi5CdZV7e8M4iULTXHYHmBE6mHtP38M:Qa/

    Score
    10/10
    agentteslaneshtacollectionkeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks