Overview

overview

10

Static

static

3

PRE ALERT NOTICE.exe

windows7-x64

10

PRE ALERT NOTICE.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    7c64789f34d005f5387105babbe5dd24.bin

  • Size

    725KB

  • Sample

    231127-cmc8tadf7w

  • MD5

    e5c3fda86aeca06f00d1ca6318203c9b

  • SHA1

    36643b3160a7ab1df1598c2af33a00bdaee82d43

  • SHA256

    1e4cae541fdee1465b553fd3fddc11e50703f9db55e6bdef47ed3971a34697be

  • SHA512

    39b39532982f1c9786531479de609173d7aeba61e5bfd8abfc736348961fbaa538e959589d75acf39e4f3e1cb62422f38c72a0352c61f28d8698e266429dde12

  • SSDEEP

    12288:YG6WcRlFX9Z6Fd/o2KK4ywD3IHmq7JjjDIdQBzLcVacZigQXTjnx0nb9szDWjoas:YG7k3tCdLKP9cGEJDQVhZLQXXx0bAagP

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      PRE ALERT NOTICE.exe

    • Size

      930KB

    • MD5

      4fabd56f994ee77c3b6c5801af8c1ad2

    • SHA1

      034f29159d5bb146ec5acad4fa1e2a0524ea7c3b

    • SHA256

      3d9a35553412df33fdb411308a79fd2858d9c51ec73a1ce46751a35839fb58d5

    • SHA512

      36c314ff0a8f3209a32af9f8b5d260c516d742889b8373c38b8ec07b31fba861eee448ebf06a21dbd9e50f1dccd1bd3983b3d5fccdf35e039cba5e7c5604e491

    • SSDEEP

      24576:pAtD/61rgywSbU5T3NUQ7yTSSiSW0FTyjP+ENasJ:K611enVSNDp0FJ

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks