Overview

overview

10

Static

static

3

payment status.exe

windows7-x64

10

payment status.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    payment status.7z

  • Size

    655KB

  • Sample

    231201-mjvnsshb7t

  • MD5

    ffbead404f6284ca066aace51346fc15

  • SHA1

    e4fb9fff898f0108fca15cc3710f22e4d7be5509

  • SHA256

    a67f076542d40afad180257af33f9b3a4b1ca1fd3f6146f030c165188bb16945

  • SHA512

    d1e5acaea6f29cd984cfd424b1341b5c1dfa884cd80dbe8f8e9bc2e155265a1ee827615c3abc18901e0a6f14cf8019a41334b03f313ddf9dcb534cd1f4b52842

  • SSDEEP

    12288:oQcrV2DZddftdzkua1fukoCRJQE8TPcPqp9wLUUFkLQj7XbM:oXrVeZHzglVukHRJUMqp95lsPbM

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      payment status.exe

    • Size

      840KB

    • MD5

      aa2bbdd4f76e86b8a34746c29602982e

    • SHA1

      65afd6aa0bf71c64cbaa3076dee472d696dd5566

    • SHA256

      391085720087ca47539076781ecfb5e4027f3c89bb19097b0c3d9e599cc6b6cd

    • SHA512

      c6888740e55c03ab9c494cc0a9e0d7271ecc009393274f332566090c0932ec5848349b803ced84c5f1bdb3a873b739c4b2058971552f195e2c9d5d850fe9135f

    • SSDEEP

      12288:S3f5A6IOwgTt0Pkua0p0lZXRYQlBTPNPqt99EUU5kLQTYCS51fn7dyx:YTaslk0l1RYmFqt95dsMCS5l7Mx

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks