Overview

overview

10

Static

static

3

SHIPPING ADVICE.exe

windows7-x64

10

SHIPPING ADVICE.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SHIPPING ADVICE.zip

  • Size

    725KB

  • Sample

    231124-ydhmtsef6t

  • MD5

    4f15b504065febdeccd218862f564baf

  • SHA1

    9fd9cda0de136c0f24b90551daba9c6580fa9337

  • SHA256

    8411d02f9c74679198a73697b3faaf3f83c4cc8fbb05af3ab9876b32089fdae6

  • SHA512

    6a91c7fde8972af2b03aaae62378f9e7d542f5f18f468e1a366748c87047f4d09767ed38bdab3ae9d7e6494d532b1bc0e63d2ec0583fcd4644c05b3df84076b7

  • SSDEEP

    12288:NGQ25Tk7qHyCKyqraw4nxUpusTnNqtA7yTsK9iqQLnqAaHAgVFzohl1uUagLh:QTa/kqew4xU/TnNUA7yTsOmCggjal1uq

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      SHIPPING ADVICE.exe

    • Size

      930KB

    • MD5

      4fabd56f994ee77c3b6c5801af8c1ad2

    • SHA1

      034f29159d5bb146ec5acad4fa1e2a0524ea7c3b

    • SHA256

      3d9a35553412df33fdb411308a79fd2858d9c51ec73a1ce46751a35839fb58d5

    • SHA512

      36c314ff0a8f3209a32af9f8b5d260c516d742889b8373c38b8ec07b31fba861eee448ebf06a21dbd9e50f1dccd1bd3983b3d5fccdf35e039cba5e7c5604e491

    • SSDEEP

      24576:pAtD/61rgywSbU5T3NUQ7yTSSiSW0FTyjP+ENasJ:K611enVSNDp0FJ

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks