Overview

overview

10

Static

static

3

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    file.exe

  • Size

    427KB

  • Sample

    230601-xzyeqsgd5v

  • MD5

    1ea09341aaff16a5e04cc3f34d75e96e

  • SHA1

    82439c05c4eb3f12ea20b723060d8bf1076bc9a8

  • SHA256

    a0ed680e73b4abeacc64c2ec1d40129614e174b527ae1cc5172f98ccc227ac24

  • SHA512

    4be8679ba2b1b10f9a0e9eaeb83aa85dac602e544db48840c1e6b14ee371e6a18384badd8fd788d606ee7c9e1859afc30c434d39e4d56f35e662a7176be825a9

  • SSDEEP

    12288:tyDWRgSXsT6vY4I8VmKbyRLzGNfZHdwvoXq:UDHSvdzgKbyRyg

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      file.exe

    • Size

      427KB

    • MD5

      1ea09341aaff16a5e04cc3f34d75e96e

    • SHA1

      82439c05c4eb3f12ea20b723060d8bf1076bc9a8

    • SHA256

      a0ed680e73b4abeacc64c2ec1d40129614e174b527ae1cc5172f98ccc227ac24

    • SHA512

      4be8679ba2b1b10f9a0e9eaeb83aa85dac602e544db48840c1e6b14ee371e6a18384badd8fd788d606ee7c9e1859afc30c434d39e4d56f35e662a7176be825a9

    • SSDEEP

      12288:tyDWRgSXsT6vY4I8VmKbyRLzGNfZHdwvoXq:UDHSvdzgKbyRyg

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks