Overview

overview

10

Static

static

3

231730028-...df.exe

windows7-x64

10

231730028-...df.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    75c88cf971ed8fc9ac73c54e831478cfae2b483c2c48a3bce48202665de1fb1b

  • Size

    449KB

  • Sample

    231204-vn594adc4y

  • MD5

    f9109b064041c84505734a32329d406b

  • SHA1

    bd4dfbf2755c5f3e5ff196b1525bd1827e56e7b3

  • SHA256

    75c88cf971ed8fc9ac73c54e831478cfae2b483c2c48a3bce48202665de1fb1b

  • SHA512

    43bca414c6053e71cbeeb24a2bddf1a583e6eb25f5ea9873d3fb5c86febf95796c79b37f335ba84c6f7634d3d646c8f9984a2bf3c5426b304f8644d9f75c051a

  • SSDEEP

    12288:nsPNV3zQLse/aeyuzBTfOlFPE3XDzOo76Zts9yb:s1VjnVnifOP832dsQb

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      231730028-2023-Dec-04 pdf.exe

    • Size

      477KB

    • MD5

      38e85567ecbe691d6319179e8e42fab2

    • SHA1

      72f8f419447da72e61518a7ecdf433a4b05aa458

    • SHA256

      188b48895639573a36270e0693569d98f7a673c975478927559c3eadd6d83839

    • SHA512

      78c77591b9e381d9b3bf962693ec00f0ae94cadee813837095d4fb1e16282a93791d03a4323a52e57870632d7e09227cba1baaeee164264fb174e64a5d7c5d75

    • SSDEEP

      12288:xkNqHWr7yJzMij4kfciX/wtf7FPEvPDvmtj9yx:xUq+IIefziB8vKjQx

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks