Overview

overview

10

Static

static

3

SHIPPING D...93.exe

windows7-x64

10

SHIPPING D...93.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SHIPPING DOCUMENTS#202993.zip

  • Size

    625KB

  • Sample

    231207-mqjj4she62

  • MD5

    6541102380b2f438c5545e5c16d2390f

  • SHA1

    8b4ddfef97cd803bb9a2f0dbb64e473e3696ff43

  • SHA256

    05153d2248e5df1b394ef03a5736f209e3bb4eec5cd88ac710d4a56e4eef3183

  • SHA512

    9e2742d59b68c43900a609fb30a1d5c0bc7aa89da24cf7fb9903e77ad7e85712f26bce891bf4f20b3b2dad026686c151920e85a905d9724323b78ebc4dc15a1c

  • SSDEEP

    12288:vWDnFsmaseWBvQZwbjyp0HHO5JTxgHs5W1DZpiChTLWTBc1JCNoFM/:vWDnFsmp9BvS6jyp0H2VxgHEW1DZpBL6

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      SHIPPING DOCUMENTS#202993.exe

    • Size

      683KB

    • MD5

      6adb7b71640a2f11f8144693e2b15d41

    • SHA1

      38c3551a6b02c88e793f37b29a522071100bced6

    • SHA256

      b5cd63c5fec95f16d9c11ca726e0bad76d52eb122a6458b3940d5dd94d3a7dfb

    • SHA512

      d5a6bca0366b1aed4c03f70defc319e70932c18d9ca89183f08479aa8d306532a50f3e06a08fe4182ae0e86e2980b5971940dca75a5a397f48da5e26d4664c30

    • SSDEEP

      12288:C4ueH5qfhisCn/zzGAfjmT0HHy5Jvjgbsfc1DhpYChjAVejJI:PqZxwG4jmT0H6Vjgbcc1Dhpbac

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks