Overview

overview

10

Static

static

3

Amendment ...df.exe

windows7-x64

10

Amendment ...df.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3aacc79d8cd0a0faabf7a4f523422c1afc768555244896be14ef322327cfbfb5

  • Size

    396KB

  • Sample

    231205-t9qabsda25

  • MD5

    58396cc26edfe69bbae48e6a19c4c7eb

  • SHA1

    ea55bf88819c31822fc80536138b08bd73de27f9

  • SHA256

    3aacc79d8cd0a0faabf7a4f523422c1afc768555244896be14ef322327cfbfb5

  • SHA512

    386250b7c027ea9d1428c684d262fc4b4737c9f3b8fe615c62d13b74a9de28a47c67c092655a4342a003a5fa86b9a685f718dbfb0da7f84c1000a0a9ac48e5c3

  • SSDEEP

    12288:/y2EqW7pDXRh4aX4CxmbEyF4TkgyJkqZE/jbFY93nxlFKJ:/y6OpLVXrO4tZjbalFKJ

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      Amendment POs 05-Dec 2023 pdf.exe

    • Size

      423KB

    • MD5

      db004427de4f603941d2f40d6a22d105

    • SHA1

      83879efd1dab6923cc56a979756c0e0cff3d4320

    • SHA256

      49c8753d20ef77ddfd436992e8c015dd23cc0a5e03429f614470321602df624e

    • SHA512

      d8a11bcb010f5a1476b05b7fe422d51e24fe2cbbbc6098ea4110fd0733cba8a99ccf7ac079fbc9484a550af5a9c183b693ae9e3e90ad10474fff2f82031d064d

    • SSDEEP

      6144:T8LxB8/leyb8dfEPuc+W5nSPWO2vR72Tl7CjfsLkt1QSdUqZEIWjbFYh7zQcjzRF:x/leyEfEE4yqScUqZE/jbFYfznxlnksb

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks