Overview

overview

10

Static

static

3

PRE ALERT ...TS.exe

windows7-x64

10

PRE ALERT ...TS.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    PRE ALERT DOCUMENTS.r15.rar
  • Size 501KB
  • Sample230609-n7fp8ach5x
  • SHA256 e91da65f2e92a516fa93fd1d80c4d141efad8714f830ec76cd1b11c65d97f95c
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

  • agenttesla

Credentials

Targets

    • Target
      PRE ALERT DOCUMENTS.exe
    • Size 964KB
    • SHA256 7e781f414da0e2f65ca8c1a8a103a9b88d2d8e4d6c53998642f271e40b29ff68
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    agentteslakeyloggerspywarestealertrojancollection

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks