Overview

overview

10

Static

static

3

shipment invoice.exe

windows7-x64

10

shipment invoice.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4615f8bff44106f4b2eece0bc7c6a6e24a673d6ad9b751b47cd9699fea345228.7z

  • Size

    767KB

  • Sample

    231206-v39aasbb99

  • MD5

    37985fd23422b47d2e52fc388b79865c

  • SHA1

    8e217050cbe23a8bb31ed2c9ef4350755f4441cd

  • SHA256

    4615f8bff44106f4b2eece0bc7c6a6e24a673d6ad9b751b47cd9699fea345228

  • SHA512

    f5ad744810093be3f4ff7fc776547e44a860dc21673a60e7f65e9eed8947892fc769ec0fabcde3a82aed054ad2574cb678bb104665fe20d608c1663a1f55e870

  • SSDEEP

    12288:bDqZ/r3kzYFnuiwgAlxAlfYP5B/SyHGJZTDHCPexBb4FyseMpu71gPXWI7hE1Eqk:bDqZTUzYoXgDlfYPr/SlJJ/xSIjMpu7c

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      shipment invoice.exe

    • Size

      991KB

    • MD5

      3d0e43113603bf2f7c7773ae08d1e03d

    • SHA1

      8d90a13d1e29bec0d4167fdcc67e6710724f79dc

    • SHA256

      91ff3998adf51757d7580e1c190ff9f4c12e9b2de48b56c7507824753a9930e2

    • SHA512

      b4a9ba85c7ce0cf04b0bc578d330910f8d03e90077466d4845af58c5f1d8c951bb78b32787cd6e871ab019da132e865c43f7f12ecced5108e20e668392574fa0

    • SSDEEP

      24576:Vb34/up+pJSpEBTxv7/S6buFPTPYMXu71oPX9Ikq2rMx:F38PJSoJ/iF8M7Pqkq2rMx

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks