Overview

overview

10

Static

static

1

INV_CNGMT_...23.exe

windows7-x64

3

INV_CNGMT_...23.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    INV_CNGMT_AT_12_11_2023.exe

  • Size

    750KB

  • Sample

    231112-ke97ksec69

  • MD5

    1b2d19fad1f79cb3e5a4dad054bbb839

  • SHA1

    914494dd5f6bc9b0ccfb34a7812d54ee60560409

  • SHA256

    79c6fb90545837f8ac314eaf24336831bf482b9dcc089d7002b990161002458a

  • SHA512

    4db81f115c358257cdf5388c8d5bdf7ff30328e9b6b6741134b9e95088d8dbe3d8aad5f6485f4a1749cef56ce080fd1512e78b67c0403c1bfdce1ed05bbe1eb6

  • SSDEEP

    12288:xCZtj1XrtQg3zwGKfez9zrLWJKoV8hgqcIpCuRNo1re3FxqbqNKRgcmBfIMDke6P:xW7XrWIwGWoLWgfeubVGROfIMwx

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Credentials

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      INV_CNGMT_AT_12_11_2023.exe

    • Size

      750KB

    • MD5

      1b2d19fad1f79cb3e5a4dad054bbb839

    • SHA1

      914494dd5f6bc9b0ccfb34a7812d54ee60560409

    • SHA256

      79c6fb90545837f8ac314eaf24336831bf482b9dcc089d7002b990161002458a

    • SHA512

      4db81f115c358257cdf5388c8d5bdf7ff30328e9b6b6741134b9e95088d8dbe3d8aad5f6485f4a1749cef56ce080fd1512e78b67c0403c1bfdce1ed05bbe1eb6

    • SSDEEP

      12288:xCZtj1XrtQg3zwGKfez9zrLWJKoV8hgqcIpCuRNo1re3FxqbqNKRgcmBfIMDke6P:xW7XrWIwGWoLWgfeubVGROfIMwx

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks