Overview

overview

10

Static

static

3

QFvswtcr1f60ol5.exe

windows7-x64

10

QFvswtcr1f60ol5.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NEAS.b6adcdc663b6102229bfa05a734251f356f453e1ec248f554293edc1234e1c2a.zip

  • Size

    626KB

  • Sample

    231202-mb2r5sbh65

  • MD5

    f498addfb90d996cb86bf815b08a1f8d

  • SHA1

    11349d18f0f4d4bb71e2b59c7d661d654f9dbaad

  • SHA256

    b6adcdc663b6102229bfa05a734251f356f453e1ec248f554293edc1234e1c2a

  • SHA512

    907c0617a1e23a06b4a9608d3578d8c4cc6dfd348742a0e08e1b0cad32819fe727ea6111a0cce9d860e8af27bde4bfdedc63252ec2ba243069b8ec430487b95a

  • SSDEEP

    12288:w1O2vze1DBOoF8hvKrlCa5Tkz2rQCjfdUwtn/gekJ+XpDV/F5rCjc+:wR6VkoF8hvKroKTm2r1jVUSn/s+XpDVm

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      QFvswtcr1f60ol5.exe

    • Size

      720KB

    • MD5

      741a5a12f09c04ea3e9016b0df5b1619

    • SHA1

      70bc8da958d222169fbbaeef24caf81dcad79403

    • SHA256

      34e80cd7697e28920dc9d333f057b29cb3e4010a8be917130a9c3137aabfb547

    • SHA512

      3b0150010c59a28dbf8206ac2210cc953538af03129af9772e0aa780209637a37496d01573222eb5f7e322da8d5910c5f40cfd0b29d7a4ea3c8ae046ac2578b5

    • SSDEEP

      12288:qhdIaRFF8dhPVYuKpqScN28sYpOI0fEPwtn/2eSJ+3pOlLAeqo9gp:qhPFShPVYu4Zu28sYYIOqSn/U+3pOlL/

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks