Overview

overview

10

Static

static

b3bcfa9547...35.exe

windows7-x64

10

b3bcfa9547...35.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b3bcfa95470b746baa5c5460e70ddda1c1392c40aacce02214f2b2b7f9028435

  • Size

    788KB

  • Sample

    221130-x24drsbd7v

  • MD5

    ad3817edcf73c14ba5ade80473528672

  • SHA1

    216dd18463fe1ca1a1fa017ca695699e43ca5776

  • SHA256

    b3bcfa95470b746baa5c5460e70ddda1c1392c40aacce02214f2b2b7f9028435

  • SHA512

    2ea208e080829e0b93fb33f163440b508c2610d0ca8d20a2d2f39d72b81337b897b5da50fef64cee1a905aed74cf82b806a979abff0c0c68e5fded4cf0a55897

  • SSDEEP

    12288:890DCE+DWjKEQo2QrhOm6nJ34QrqRZK6Tq3Ec8HpLwF4Ge9G0MkcWBSVWde/icqJ:89uoDcVr1SJ3TD6TYEiF4Gz8jS

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    server122.web-hosting.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    OJZg,yx3yFHQ

Targets

    • Target

      b3bcfa95470b746baa5c5460e70ddda1c1392c40aacce02214f2b2b7f9028435

    • Size

      788KB

    • MD5

      ad3817edcf73c14ba5ade80473528672

    • SHA1

      216dd18463fe1ca1a1fa017ca695699e43ca5776

    • SHA256

      b3bcfa95470b746baa5c5460e70ddda1c1392c40aacce02214f2b2b7f9028435

    • SHA512

      2ea208e080829e0b93fb33f163440b508c2610d0ca8d20a2d2f39d72b81337b897b5da50fef64cee1a905aed74cf82b806a979abff0c0c68e5fded4cf0a55897

    • SSDEEP

      12288:890DCE+DWjKEQo2QrhOm6nJ34QrqRZK6Tq3Ec8HpLwF4Ge9G0MkcWBSVWde/icqJ:89uoDcVr1SJ3TD6TYEiF4Gz8jS

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks