Overview

overview

10

Static

static

Consulta d...ra.exe

windows7-x64

10

Consulta d...ra.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Consulta de compra.exe

  • Size

    300.1MB

  • Sample

    221202-lnbwtadg27

  • MD5

    4a6c4f83ba59f169f41a77eed6d08fd3

  • SHA1

    725e35e280c140840263b0a47d449b9e03e36942

  • SHA256

    4a5d563e7519d9b2e7321abc2aa2355ecb22ed8d60e34061a0f935757a6a0f82

  • SHA512

    2fe598182197d0f1ca7750ec9ff5ab15248a8611e6165a9449af30ca7fe206acff80a8bef179badf4100379dea18db8c94a3738bbf8c1847ec1b854159805c07

  • SSDEEP

    192:jr0QjqirBzCL7eOIQSz16nbP3IwKu1AVxxlK4QzwU94aMVv0L:v0Q3rBWLmnz1MbvTKEAVk4QzwU9jA8L

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot5954474519:AAEGnfW1mRvGRxq-zIAvwJfpKEbhLLiqVaM/

Targets

    • Target

      Consulta de compra.exe

    • Size

      300.1MB

    • MD5

      4a6c4f83ba59f169f41a77eed6d08fd3

    • SHA1

      725e35e280c140840263b0a47d449b9e03e36942

    • SHA256

      4a5d563e7519d9b2e7321abc2aa2355ecb22ed8d60e34061a0f935757a6a0f82

    • SHA512

      2fe598182197d0f1ca7750ec9ff5ab15248a8611e6165a9449af30ca7fe206acff80a8bef179badf4100379dea18db8c94a3738bbf8c1847ec1b854159805c07

    • SSDEEP

      192:jr0QjqirBzCL7eOIQSz16nbP3IwKu1AVxxlK4QzwU94aMVv0L:v0Q3rBWLmnz1MbvTKEAVk4QzwU9jA8L

    Score
    10/10
    agentteslakeyloggerspywarestealertrojancollection

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks