Overview

overview

10

Static

static

3

Invoice & ...st.exe

windows7-x64

10

Invoice & ...st.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    Invoice & Packing list.r15.rar

  • Size

    428KB

  • Sample

    230828-m59d3sdb5y

  • MD5

    99ffdd3978f06a6ff2bafd2d72ee7703

  • SHA1

    a5a490e969b07ed7a2d55267d15cfdb49e6b3461

  • SHA256

    c52c725fbd2ce6317b9330224b30bff68c7e4d8acadae819a206451ee7c23ebe

  • SHA512

    d488a3525d46aed66d754a0af68dbce29dd86be554393401837a3fcdb0e51285241f8767e56ac6ef15856433cb500f291b8060d8da8a97664eea584357ff983a

  • SSDEEP

    6144:u1sEcJH49avC5U0BcnwU3/wRmisE8cg7orFplEoncP1cnmC29TZYMl5UgZqdnJ9Y:uGrN4A9vsWk7F/7mcZ4NHlzZzLzysXH

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      Invoice & Packing list.exe

    • Size

      868KB

    • MD5

      abb06c99920f6b7a0fc1b1a8fb329d3c

    • SHA1

      57a5e9dd27948147935710b5e299d83fafad3f93

    • SHA256

      e0c3c6252a6d0fd8979a30bafbf4d41cd9d0868ac1a1b72fa7165d1761d68fd9

    • SHA512

      b7f5cbe9989c422bf040e4a2be4f34882631a8c8d25e6254fe7d99bd8cdb8f30398e9c88f630ceefa43e459e0b27ebbe7e30cbbeef57bd3fe7ada57473a6a0bf

    • SSDEEP

      12288:9+70pKXQl2FNGprSWr7Kr1gUfCG92I/R9d2+pCZ9GPk+hU9:E671g9higC

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks