Overview

overview

10

Static

static

63d8c6d5aa...59.exe

windows7-x64

10

63d8c6d5aa...59.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    63d8c6d5aa91ded15e59599571aff23a5713be59

  • Size

    783KB

  • Sample

    230104-qlhc2aga85

  • MD5

    9bd05e2bf750cef915157ceebf7478cb

  • SHA1

    63d8c6d5aa91ded15e59599571aff23a5713be59

  • SHA256

    9a925e5f7a296bce2b8c8a0f84fbc2eb25567569586e7deac35ae8290589eb08

  • SHA512

    7c1290b3ddacb7396412341b75645de045158d51c8f3b6af4b0e76efa587dace542faa0d794b041ae2b5d60e9a9aef37137b634421ba8f2967ee98a5a28e8b08

  • SSDEEP

    12288:G22ULyS1sOE7Gks45yfO/xIVulhbaL7ZemY:GoyS1sVGke6qol9aXZPY

Score
10/10
agentteslacollectionkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.clipjoint.co.nz
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    melandloz64

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      63d8c6d5aa91ded15e59599571aff23a5713be59

    • Size

      783KB

    • MD5

      9bd05e2bf750cef915157ceebf7478cb

    • SHA1

      63d8c6d5aa91ded15e59599571aff23a5713be59

    • SHA256

      9a925e5f7a296bce2b8c8a0f84fbc2eb25567569586e7deac35ae8290589eb08

    • SHA512

      7c1290b3ddacb7396412341b75645de045158d51c8f3b6af4b0e76efa587dace542faa0d794b041ae2b5d60e9a9aef37137b634421ba8f2967ee98a5a28e8b08

    • SSDEEP

      12288:G22ULyS1sOE7Gks45yfO/xIVulhbaL7ZemY:GoyS1sVGke6qol9aXZPY

    Score
    10/10
    agentteslacollectionkeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks