Overview

overview

10

Static

static

1

POM21002942.exe

windows7-x64

10

POM21002942.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    POM21002942.exe

  • Size

    1.0MB

  • Sample

    230403-gm2nmaee4v

  • MD5

    6484dc4913b3adb16c159b7ea00ff294

  • SHA1

    9870c0cfa3aa9afa49cc996cb2e8fa89486e3f23

  • SHA256

    30272b6380cb51f1ea1c8ba3c294fe504fb80179d4ac31cfa8eb641919137eca

  • SHA512

    d467be2354ebedee7f35ab5202fc8c3fde8a56a131af2d825b8678f57983d01d7fa6b6390e12c4634fb32c011dfcccb59f17af66370e49c8af7115b3100a0461

  • SSDEEP

    12288:/VKgbTjDbjZniAWt1m8nF3p44ZUf8O6PiyywVjjZNaUXcEGQLZCD/EdptyW5QHqR:kuTjDvFiAWt1mIzDifD6PUwVX

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      POM21002942.exe

    • Size

      1.0MB

    • MD5

      6484dc4913b3adb16c159b7ea00ff294

    • SHA1

      9870c0cfa3aa9afa49cc996cb2e8fa89486e3f23

    • SHA256

      30272b6380cb51f1ea1c8ba3c294fe504fb80179d4ac31cfa8eb641919137eca

    • SHA512

      d467be2354ebedee7f35ab5202fc8c3fde8a56a131af2d825b8678f57983d01d7fa6b6390e12c4634fb32c011dfcccb59f17af66370e49c8af7115b3100a0461

    • SSDEEP

      12288:/VKgbTjDbjZniAWt1m8nF3p44ZUf8O6PiyywVjjZNaUXcEGQLZCD/EdptyW5QHqR:kuTjDvFiAWt1mIzDifD6PUwVX

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks