Overview

overview

10

Static

static

3

PO.exe

windows7-x64

10

PO.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    PO.exe

  • Size

    877KB

  • Sample

    230605-qk3mksgg88

  • MD5

    6fc2dda1d86053efba968f33169b9c9f

  • SHA1

    f7fdbd8d3f498ff66d26435a422eb7f4322d6c01

  • SHA256

    9e7910da0fdefe5822be59e1084d1dffe2f4bcbd670d2bab6da75718653c69c0

  • SHA512

    0792943b6a2d2c7232278fbdcc3edfe17e0ea9a51fa8220d73fb8df7251e3593744e7a8f22a384b9e1a3c05f42d311dc0ef45570381574a9a76b08b248c654c4

  • SSDEEP

    12288:ZtFvmlZy/gJAlakm+0owBAYjZm1XUPO+/qQKIWSgG:ZtpmO/AINm+0owBNjZm1XUPOHdlSg

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      PO.exe

    • Size

      877KB

    • MD5

      6fc2dda1d86053efba968f33169b9c9f

    • SHA1

      f7fdbd8d3f498ff66d26435a422eb7f4322d6c01

    • SHA256

      9e7910da0fdefe5822be59e1084d1dffe2f4bcbd670d2bab6da75718653c69c0

    • SHA512

      0792943b6a2d2c7232278fbdcc3edfe17e0ea9a51fa8220d73fb8df7251e3593744e7a8f22a384b9e1a3c05f42d311dc0ef45570381574a9a76b08b248c654c4

    • SSDEEP

      12288:ZtFvmlZy/gJAlakm+0owBAYjZm1XUPO+/qQKIWSgG:ZtpmO/AINm+0owBNjZm1XUPOHdlSg

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks