Overview

overview

10

Static

static

3

new invoice.exe

windows7-x64

10

new invoice.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    new invoice.exe

  • Size

    631KB

  • Sample

    231106-rtj29sbg3v

  • MD5

    becf866a427725c60201053c7ad2fc2b

  • SHA1

    d1349e123509e8ddb230f23f8d4f2459aa67e545

  • SHA256

    64898357ce95b4c3c20b0e219efcf4d2f9c894f0e46160e11e49a54e3420b4e0

  • SHA512

    9b0abc09c8629877e33d13a5c8d6d3819d0f8536b6dd4a4b819743deb525abf945ef14cd79c965978ed29ec6fd81cbaca2e96fb9cd97c067d7453fdc4eb11cb2

  • SSDEEP

    12288:M6WHdn7wwCD7PRQZ9Y5NMGdk2bt+DwcZqgp/k6CIoM:MtHl0pH5QZ9PCJ+k8qWk6CDM

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      new invoice.exe

    • Size

      631KB

    • MD5

      becf866a427725c60201053c7ad2fc2b

    • SHA1

      d1349e123509e8ddb230f23f8d4f2459aa67e545

    • SHA256

      64898357ce95b4c3c20b0e219efcf4d2f9c894f0e46160e11e49a54e3420b4e0

    • SHA512

      9b0abc09c8629877e33d13a5c8d6d3819d0f8536b6dd4a4b819743deb525abf945ef14cd79c965978ed29ec6fd81cbaca2e96fb9cd97c067d7453fdc4eb11cb2

    • SSDEEP

      12288:M6WHdn7wwCD7PRQZ9Y5NMGdk2bt+DwcZqgp/k6CIoM:MtHl0pH5QZ9PCJ+k8qWk6CDM

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks