Overview

overview

10

Static

static

CREDIT NOT...22.exe

windows7-x64

10

CREDIT NOT...22.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    CREDIT NOTE 11-13-22.zip

  • Size

    546KB

  • Sample

    221228-m45phadc8s

  • MD5

    73c2b20ada796ed2db6f01d34a20d947

  • SHA1

    b5dca1af04a48437a0e6e0234497a05313f9670c

  • SHA256

    b1f282dadfef931b6e3b41353b3cc674709521a3d0f517bc224e0a10feebb572

  • SHA512

    27dd52bcf6ca182cca5d263f9c0e20e0c59aa0886c78f95f77bb49ef016bada0471e585f6ff20d02aea883f073fdf86123a05156e9a2e2acc182a51e39a267f1

  • SSDEEP

    12288:BEF/2QAUXzQV+AcDgZQtMxFJWdYQa/C181qILGIxa:Kxx7XzFJDgZ/+X7mqN+a

Score
10/10
agentteslacollectionkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      CREDIT NOTE 11-13-22.exe

    • Size

      916KB

    • MD5

      f74fad3bdb4072c274f420171e108ce3

    • SHA1

      8251c8f650ff10ac458dc9ec87e6316d773c6c27

    • SHA256

      1787a174f2a65c7b8997c8d21b4d9215f0997677184fc937a7a8457bebe8a1e0

    • SHA512

      57e49e8fb27b4458c4d177b0f97e8f7772bb94f37860b99a00d8cafc775ec1ee66caf49fb272ae643b9a03dba6bf0aaa9547a7131f8eb6991cad13a92f866e5c

    • SSDEEP

      12288:pU9v9A2XzQV+w6DgPQt0xFJMSaL7fG1IY/WdVgTCaWUUFM0R:pGFTXzF9DgPt3aXO1AwGM0

    Score
    10/10
    agentteslacollectionkeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks