Overview

overview

10

Static

static

3

FB-108N & ...��.exe

windows7-x64

10

FB-108N & ...��.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    d158b9c86d15735ad680bb854a398c63ad9ff4ae7bee57ac1c495cd46bcedb57

  • Size

    462KB

  • Sample

    230830-jc5cwade5t

  • MD5

    11b67b094982ad3471970133de1fc3a5

  • SHA1

    c8b8fa589caedea89e53494df77dc54a7e2876e0

  • SHA256

    d158b9c86d15735ad680bb854a398c63ad9ff4ae7bee57ac1c495cd46bcedb57

  • SHA512

    0202b8f7b182d5e050ed6de6290d281ca5444133f45715c55dc249e91e22860c4f54de9c3fec06490814bd27a9edd3bdbe45425e9034930c606bfa74bc1cf852

  • SSDEEP

    12288:U+0zNPvEMgHfLh5Xyqa2C2v+ia/7eE4yA2fLmt1DrP/TsgRU7oavA:UPzNHXg/Lh5XyWGisKUAEG1Dzj04

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      FB-108N & FB-108NK 詢價 - 田勤.exe

    • Size

      476KB

    • MD5

      503e9936a39929b17392f57e75e57676

    • SHA1

      e69543ce8746377cc08eaeff376027c34f5ed61d

    • SHA256

      2c34bfc1850ed733173329e35f6ccebaaf9f279beeb84c76f86f4b3b7badf3e0

    • SHA512

      69aa5fd6b640bf17896b3b965270ca56e6460ce55c95a460aae6672243009f91f02fd278fe9eb5253c94e4ade6d8572b45c6cbfd43a704814ecfef83c22c68fc

    • SSDEEP

      12288:Qv6uzNPg1P2dfKuZMW4cBurCviFpKPvrP/Ts6Rs76a2:QvBzNuPfuXtaYiFU3zzQY

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks