Overview

overview

10

Static

static

3

1e58093d8f...65.exe

windows7-x64

10

1e58093d8f...65.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6281c6036312d97154024e12f8b99ae3.bin

  • Size

    544KB

  • Sample

    231011-pt6j6ahh86

  • MD5

    cce076e83ced378e18b142a3ea21e842

  • SHA1

    816bc6a244923e96f8eceabdda682442f257de5c

  • SHA256

    c3f27cddff700f76873d9127a5798d1322afbc063e349265bb3f86545e056d39

  • SHA512

    b056e9fcef5b5540760f0c18c73b86b0392d252affac90a233a7a6eda2eb70f95ca69a056fbd0e2d5f625bc5db9178de1066954653b1ec4ebf41103418d03945

  • SSDEEP

    12288:mVsR/EuNCZqUhSS1UDV3GmmXi6IOA3UydNcTBZLCBGECszCap/p:5BNCZqnSyDV37ei6FwcTBNgR

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      1e58093d8f9fbd98920435ef868b14e507c33b137b2f9d415f250334db8c2d65.exe

    • Size

      822KB

    • MD5

      6281c6036312d97154024e12f8b99ae3

    • SHA1

      f8a03d09d40ebc5cc4a1e962fc3af809d6a51883

    • SHA256

      1e58093d8f9fbd98920435ef868b14e507c33b137b2f9d415f250334db8c2d65

    • SHA512

      eeefce240d0143bbeeb6d107d7028eec5af1754dfe6cdc936d91d3971e26ccd7d3490c3a68f081aa9e7bcf58bc62ec3be37102cc006670b55e20ada6b044b16a

    • SSDEEP

      12288:rOTN65b3VJN8vESN1FFkF4TFWAN+DY4sPlyDNZuD5j+A1q7JfdEQfQDRw4fi3eye:rOTN65b3VJZv40AN+s4s9DcJVE1

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks