Overview

overview

10

Static

static

3

PRE ALERT NOTICE.exe

windows7-x64

10

PRE ALERT NOTICE.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PRE ALERT NOTICE.zip

  • Size

    674KB

  • Sample

    231124-jfa87shf7y

  • MD5

    28826531e8dacd56928090ae7063cb83

  • SHA1

    2ed25aa96acfa069ec90efa271ab835edbad9f57

  • SHA256

    5cf604ed1b9d5d18625e82b4e727e1fa12b1a3eaf9dde01e3d36103e1d532bbd

  • SHA512

    ed64ebb28338bcbc05eb68561b3f2ff5e2ba7f60322110c7202416f0483b989e9671113ddcbb773062e1cc8932d8215dda4be2019ea7346a703f5ae1e629caf4

  • SSDEEP

    12288:ZLTq7346JLzYnXieaW2A/PPD3CdUkQj1YBKn5YRomwL3:9e734QxPWlP/kQCBu5YRoHL3

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      PRE ALERT NOTICE.exe

    • Size

      740KB

    • MD5

      84d6854899e7c442c48d8852b3494b71

    • SHA1

      077936c86a4ef360e92c3733abfc6633193d9583

    • SHA256

      8bbed58c768c4123970a67377ef324e3395883269bdc99a5bf97853eb551d70a

    • SHA512

      369d27e20ee777c5d8bb843fbb75e4174cd930df50dceab52c6feae5500542d000f2a2eb278b6cb6574cdbf9c7202b58e0b54b0c5c8e6a0e1780325216729fc3

    • SSDEEP

      12288:s1CFpELXGkJldiJxzHxOz6Awe/DpDpCrUkIP1CLmZD+9Km87XvauYqD8J:s1CFpQ2k7CH0z6ALphkIkLUD+9Kf7XyJ

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks