Overview

overview

10

Static

static

3

chima.exe

windows7-x64

10

chima.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PO.1102123.zip

  • Size

    729KB

  • Sample

    231204-ktswvaaa5v

  • MD5

    0ffa139bcbc1edf5e5313d8d7ed14038

  • SHA1

    cea5d1e282efaad4aafb3298c3367b988cdc0ffc

  • SHA256

    4b73acd7c0af9db5f56c5b9d44716860d21de7bd423eee3a7003de1e0d540fc1

  • SHA512

    0c5234412d1b15768174410c32f492c40c5311dbb2f67a0ce5ed885d70f58c610c404529095376e2bd8facdcc1d7438f146e108f93628265e4c329677eaf0c20

  • SSDEEP

    12288:AoHUiXfM9hPjFh1bgzyL3vgO5t4npnKacRJyMRfcUzYWs/xLPMhzKHtV70IvITxv:G9hPjFQYKnpKactuUkxLPMYNVdwTtPb

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      chima.exe

    • Size

      812KB

    • MD5

      9fdc58e77c21bdc493d017806c814791

    • SHA1

      87d45946cb600a4c1bcb30269187124c5fa0e8d1

    • SHA256

      f17888c39de05db240eac5f53edc8ad9c1b1512c428dfcce5078bb9636395a8d

    • SHA512

      104b1ac6a5dde7bbff09fd40589e2ff7bae999901b7eaa6ba5cb5419112fdd206a2c78445425a63905223e7d014250f2d4dd69a64820166f6be56996bb8a8337

    • SSDEEP

      12288:WWytW8G34/uK45+po2cOe9aPgt4npNKacCeIvzMGD1tkChTlCoXtn70IQIVAxqn:l34/up+pJw6BnpgacCeIlDZTlHdndwx

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks