Overview

overview

10

Static

static

3

INVOICE NO...10.exe

windows7-x64

10

INVOICE NO...10.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b18cb65ec1875428dff75fe82793bb8f96588f1f75395e777e29cb9ac87f5551

  • Size

    340KB

  • Sample

    230830-cdlhtscb8y

  • MD5

    2e542e3a1baab8e952721f8423e904af

  • SHA1

    59805238546cbf07bed1d986d47a7fa133c35542

  • SHA256

    b18cb65ec1875428dff75fe82793bb8f96588f1f75395e777e29cb9ac87f5551

  • SHA512

    0e8a8fcc6020914f8f798b4d25fcec64660d354c113d189fd8f28b96a4a2d04097c57534da6bdf755761f1260138c57fa9efd2e33a35651788e40f618b4297b2

  • SSDEEP

    6144:SXXBhMs6t6MV5oQn0we6TSQN9yLrzZMutCfoo/1MIJ/Lc/K7UXX+w2QI8UyDw:SXXI6MVW7LJMug/9MIJ/Lnw2QJhU

Score
10/10
agentteslakeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      INVOICE NO. USF23-24072 IGR23110.exe

    • Size

      856KB

    • MD5

      ee5297834a12117e086f4058579eeaae

    • SHA1

      58cf7e7768ac9f4523512a0478dcfdad02ed8bae

    • SHA256

      e6b1ed4a7622c05fc9ed9926fd1c8ccc18678d1100e8e59830f4734e95392d3e

    • SHA512

      0165b7816fef0685dfe1add30285f4813d8624304dc3e7ed1519a6b3943183e5670156bc2e19c6868690cbdfca1b28c635bfd86fa1350602fb0601bbac29c243

    • SSDEEP

      24576:qFPoZUtK4G0vhaOGuKKVDOUbKqNlT9CtH:/W00v8OIqNlu

    Score
    10/10
    agentteslakeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks