Overview

overview

10

Static

static

3

Invoice_HRD231022.exe

windows7-x64

10

Invoice_HRD231022.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    Invoice_HRD231022.7z

  • Size

    535KB

  • Sample

    230718-h2hdzagh22

  • MD5

    de506e178279f35a8d7c1ba89700803e

  • SHA1

    a85541c7fc6e9eb8bd7f7a702262573cbcb59e70

  • SHA256

    2804c7fae5f403613673a2c57206dbfb0c4f70936970965875f8c3ae6b96d24e

  • SHA512

    8955c3eb9ff9422d8716056a3e024223716d06b2c89d3fdb353911dabe4a691ff37d4ce68307f40ae15586bfb0a6036391b57e7e86e919b44eb92289e26917ea

  • SSDEEP

    12288:27dDfG96AklsroYrLGwUY8+Xs9SdNSZ8Vd0kYpGXTqH:GdDlAtMY+YL89SQ8VyV7

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      Invoice_HRD231022.exe

    • Size

      890KB

    • MD5

      2fea3e4bf710d748c9cb23109af3a3cb

    • SHA1

      98ecf275558a81474d356f108c830efec6d9be6f

    • SHA256

      64d63223e23705dc8b278f039e7b1fa092760543a3527ffaae0c0a0d43835d00

    • SHA512

      d16c31d68ed934a1fbd0b35d7041dd71b33a8c41db1b52d67e6ccfc4a6cee7f0432741c8f21efd2a3657f46787e49177ad4131f3afcd417014d97d666aa7990f

    • SSDEEP

      12288:dIFGQIut7DO2xK6oZlsroYuLxafY8dXEUSdNSZxXd0kYxWm0fJo1mJxRHHE6mRs0:dIFz7RzoIMY/Y0UUSQxXylr0fJYOW

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTeslaV4

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks