Overview

overview

10

Static

static

1

tmp.exe

windows7-x64

10

tmp.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    tmp

  • Size

    1.0MB

  • Sample

    230403-snv31sfe62

  • MD5

    3573cfa28e62b14b3a8189063065c8bc

  • SHA1

    16880f808ff4cbf50575f2cdba5ed4d2d13ef517

  • SHA256

    3678eacb8a54a9b0112aae9c691b5ddbbe86631d17689abd544a1acac76c1ce8

  • SHA512

    e7bafc37a0b52259de077ed2722acc363e354846163e5f39a8719b3df703f72ef4a702b83c92c4cf212c396c0c4128a40382cfbba75a58b8a886bff42b57d8b2

  • SSDEEP

    12288:dX9JvxrmCjZ+yywVFUS6tleliDFjvLdMcKT5i7ZfgpopMcTpVdLjZkdE2ajTIbIQ:1J6uuwVFf6tlBFdMc4Q7e/+XB

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      tmp

    • Size

      1.0MB

    • MD5

      3573cfa28e62b14b3a8189063065c8bc

    • SHA1

      16880f808ff4cbf50575f2cdba5ed4d2d13ef517

    • SHA256

      3678eacb8a54a9b0112aae9c691b5ddbbe86631d17689abd544a1acac76c1ce8

    • SHA512

      e7bafc37a0b52259de077ed2722acc363e354846163e5f39a8719b3df703f72ef4a702b83c92c4cf212c396c0c4128a40382cfbba75a58b8a886bff42b57d8b2

    • SSDEEP

      12288:dX9JvxrmCjZ+yywVFUS6tleliDFjvLdMcKT5i7ZfgpopMcTpVdLjZkdE2ajTIbIQ:1J6uuwVFf6tlBFdMc4Q7e/+XB

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks