Overview

overview

10

Static

static

1

PO#3210046374.exe

windows7-x64

10

PO#3210046374.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PO#3210046374.exe

  • Size

    721KB

  • Sample

    230216-wjtk6saf2v

  • MD5

    67b6910eb5ac23f304809463e6e61325

  • SHA1

    1b05a7e40acbea5ce09ddd4926bd68620d86998e

  • SHA256

    72e713d25be6feb7c88cddfd471d9836371bd44cac7199cc1c44838e6946b807

  • SHA512

    95cec34bdd44320d912f5a34d8fa87c57958746924691771a6d3ffabd7120697086236bcadd63cdfd99d8f3f20a7a32454087d1786b88466e2d2f8d4e5d5f96d

  • SSDEEP

    12288:LCykIkegET9jsIBMNjnNNOhAe/S0XD+/cs8z5x2NVW1Ojkdd/QfjqabiUxFYgY4:LVTsIBMNjnNNOhAe/S0TZ2mykdYqL+Ff

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      PO#3210046374.exe

    • Size

      721KB

    • MD5

      67b6910eb5ac23f304809463e6e61325

    • SHA1

      1b05a7e40acbea5ce09ddd4926bd68620d86998e

    • SHA256

      72e713d25be6feb7c88cddfd471d9836371bd44cac7199cc1c44838e6946b807

    • SHA512

      95cec34bdd44320d912f5a34d8fa87c57958746924691771a6d3ffabd7120697086236bcadd63cdfd99d8f3f20a7a32454087d1786b88466e2d2f8d4e5d5f96d

    • SSDEEP

      12288:LCykIkegET9jsIBMNjnNNOhAe/S0XD+/cs8z5x2NVW1Ojkdd/QfjqabiUxFYgY4:LVTsIBMNjnNNOhAe/S0TZ2mykdYqL+Ff

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks