Overview

overview

10

Static

static

3

IMPORT SHIPMENT.exe

windows7-x64

10

IMPORT SHIPMENT.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    IMPORT SHIPMENT.exe

  • Size

    488KB

  • Sample

    230828-nfqfcaae54

  • MD5

    f86305e5c746b158c7f248ef34e953da

  • SHA1

    bf91723e19ca7822f3ff646e9e1571fff85708f9

  • SHA256

    ba622fd7d8cbe31e6e0015cd59bee84d15d0756d6a765e5d2725bdc210627f6d

  • SHA512

    41f1bd01e28b05a2a4b96ba6ba86473d17026df64e10deac8d4b0a69267d291f519065d6f056a52523a6245b54a68fe059a21d922a14b52b2a7fb09b92780544

  • SSDEEP

    12288:gmlCM+xLNSMh69iBmw5jVSeNCTFgJCrrMzCh1XAhlW9Mm6+70pKXQl2FN:gbbpht2eQYCrrDl

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      IMPORT SHIPMENT.exe

    • Size

      488KB

    • MD5

      f86305e5c746b158c7f248ef34e953da

    • SHA1

      bf91723e19ca7822f3ff646e9e1571fff85708f9

    • SHA256

      ba622fd7d8cbe31e6e0015cd59bee84d15d0756d6a765e5d2725bdc210627f6d

    • SHA512

      41f1bd01e28b05a2a4b96ba6ba86473d17026df64e10deac8d4b0a69267d291f519065d6f056a52523a6245b54a68fe059a21d922a14b52b2a7fb09b92780544

    • SSDEEP

      12288:gmlCM+xLNSMh69iBmw5jVSeNCTFgJCrrMzCh1XAhlW9Mm6+70pKXQl2FN:gbbpht2eQYCrrDl

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks