Overview

overview

10

Static

static

1

LOS No 140491194.exe

windows7-x64

10

LOS No 140491194.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    LOS No 140491194.exe

  • Size

    676KB

  • Sample

    230403-p6x4jseg98

  • MD5

    ba67bb555e5e1d845b4e549df2c8b493

  • SHA1

    ff966c9355cbc922e0eb162d8dae6db2244267da

  • SHA256

    5b58f94841a17d6f347c5d32f4ac2e2fb6d7e4954d65b5138ed7fb44c924c3a0

  • SHA512

    6414fcf1c07c6c6a78f0a71a040b2ad0df764ac59168b3fb49ccaafd4bdb356c3974710e8475d4bed37f22efc14967f6b9218d8f5d779ab05402cefc469a2bcc

  • SSDEEP

    12288:HKPFSPmnULyywVBGh0NaHo3EpGs3TH8HzZF/gxMdib/:HiFS2UDwVBNNYoUpZTcFg/z

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      LOS No 140491194.exe

    • Size

      676KB

    • MD5

      ba67bb555e5e1d845b4e549df2c8b493

    • SHA1

      ff966c9355cbc922e0eb162d8dae6db2244267da

    • SHA256

      5b58f94841a17d6f347c5d32f4ac2e2fb6d7e4954d65b5138ed7fb44c924c3a0

    • SHA512

      6414fcf1c07c6c6a78f0a71a040b2ad0df764ac59168b3fb49ccaafd4bdb356c3974710e8475d4bed37f22efc14967f6b9218d8f5d779ab05402cefc469a2bcc

    • SSDEEP

      12288:HKPFSPmnULyywVBGh0NaHo3EpGs3TH8HzZF/gxMdib/:HiFS2UDwVBNNYoUpZTcFg/z

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks