Overview

overview

10

Static

static

3

payment ov...2).exe

windows7-x64

10

payment ov...2).exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e5b705e1be26c11deef73ef07f01c2403c63eeda1587bd7604e3a4dceec2bf05.7z

  • Size

    634KB

  • Sample

    231202-lnzymsbe7s

  • MD5

    7a7b91d6b66cd23fa879506eaa0cb829

  • SHA1

    95e422b7612ed3262577d4a35c8a135552c94df7

  • SHA256

    e5b705e1be26c11deef73ef07f01c2403c63eeda1587bd7604e3a4dceec2bf05

  • SHA512

    e749ab7f4fbba75acb6c58a1d31a3c692b2b28fbcd5785fb1d4cd83278c31804de43aad724e2915c00322ae813fdc8bf3ed5313922c01a966b00f5a427d6f429

  • SSDEEP

    12288:IXRp6d4oY1dhwhKWtGMzfo3cyjuola/d+4HU6e9+hXpKE5ls:IXRp6d4oGhLWLzfo3cOlaISjhXQ+s

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      payment overdue (2).exe

    • Size

      837KB

    • MD5

      13e7ae190b0ab1250c199ac339217231

    • SHA1

      625b25670a86a8b9a7808d226919dec2a224339f

    • SHA256

      951f66b51f796de5f9298aa1f97c49e392083f6b570fb31df72610999fb50769

    • SHA512

      4eda095b17e782f4cc8ed58379d1787928e4fb32899069c48fbddc972e203c61cb93d9ffd1d7fb5220c7da3614814a75f7f42068480d707f60f1a8f11a2e438e

    • SSDEEP

      12288:yvmSJD+IFgicSDKNfGAIko3cajHh84/dUNMgBe9+hXpKm0qE+Fq:YmSJD1ZctNbIko3c684KiKhXQ2

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks