Overview

overview

10

Static

static

1

57e95606ed...d4.exe

windows7-x64

10

57e95606ed...d4.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    4e7c76506aa7aef81d568b1389c9d6ac.bin

  • Size

    144KB

  • Sample

    230311-bsq67aga75

  • MD5

    953d4378c2c37c1bbab625a43f336c39

  • SHA1

    5957a6f851efd32842e584998623c0815cbf1568

  • SHA256

    4705ba79626712b336332457a6ff3cd7c376533bfbdf95f2fee88e9145860287

  • SHA512

    3ba4782c829ef72ee807e00ca5d924f4b4ad2c7705303f8f31f8b3d1773fc685f8d13425799e76cb20fb7b22a60a8b63013b803421a982eeeafd55116ae3d283

  • SSDEEP

    3072:Bb91vY4uaYHHUz7bChPLmZ8cjNCiFSKdLwmV6fhm0ePVjkACxSNHvj:Bp1Y4uaYnoC08cp74KIMZkACxMb

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      57e95606eda02383d8fd97dfed2ed299370fb3f2fb387c6dd52edc953c2ad4d4.exe

    • Size

      347KB

    • MD5

      4e7c76506aa7aef81d568b1389c9d6ac

    • SHA1

      5546c9fd2ede0b0ac302e025a6eaeca453ab85d2

    • SHA256

      57e95606eda02383d8fd97dfed2ed299370fb3f2fb387c6dd52edc953c2ad4d4

    • SHA512

      ed4eb9d96dbba70a7dbe0b6c127fe39f2dc6bdc5e584bfcb1424a79556327d44d663f540409c9d8b77702fbf516fc7ae9bbe9f52f815f089d1a84d5eaa622ff5

    • SSDEEP

      6144:jdA7iB04vw6GtpsPwwyLhOOA5AHtyHqo/ZfYpGpR1TSsKY:e7iHw6GtpsPwwN5AHtyK0JTS

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks