Overview

overview

10

Static

static

1

Packing list.exe

windows7-x64

10

Packing list.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Packing list.7z

  • Size

    438KB

  • Sample

    230208-ld2pgshh94

  • MD5

    8465786cff9bb83d05a52f79378e3b81

  • SHA1

    1206492bb1e49355dec618472b15eaa86d831dbb

  • SHA256

    95b419bb95e4fc43a53e70b4841a2712099eefaf1011443099d52094045a5f09

  • SHA512

    608f7a00f74c7cf59f874117ab23c696e61da75d15f14923792958b670bf18b87549989d9cc6bde21c70e2aba9b27e0ecb1caf76e70845fbc170084a9d23fca5

  • SSDEEP

    12288:kjjDnVpJ9qwL5hHufPPugO8pyO2tapMP/l:QjDVmnugO8pyV4m

Score
10/10
agentteslacollectionkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      Packing list.exe

    • Size

      701KB

    • MD5

      9b76d76a13b2d20a0ba82fb3571ab477

    • SHA1

      e377c4a293b23dbf90d92a18ec80fc8aadf6153c

    • SHA256

      2bbff6d93b38a6ffc24b7f707edf5686e0cf5e92889c0a467ff37ab74198bd1d

    • SHA512

      effb9b8a6419a21f3676a440ccdc7a56a940b9e9b39192d60b460c4014d21a6b775521e88a764a943fc6bd6e4e0141b62cb18990e7dfd96bfdc2ff27b29c0775

    • SSDEEP

      12288:42KFLDne7f4WYMTyPdLX2tuCAe/ZXZ4niDJ9qDLOKHpLPPubh8pWCgJ33333333J:45P7MTyPdLX2tuCAe/ZX6nnnnubh8p5c

    Score
    10/10
    agentteslacollectionkeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks