Overview

overview

10

Static

static

3

0a2dd7c7f3...b4.exe

windows7-x64

10

0a2dd7c7f3...b4.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    0a2dd7c7f33945c9f8d0d572fdea8eb4

  • Size

    737KB

  • Sample

    231230-byme7abahp

  • MD5

    0a2dd7c7f33945c9f8d0d572fdea8eb4

  • SHA1

    35eedbf87d0db7f098c164fa2dfd648023ea5ea8

  • SHA256

    c0351986edde88da74cc051c26fee9466569d49773c0984439d544037341bb6c

  • SHA512

    00622f3750d78d9197ba87b8578ebb38bb63fe6e6429cc75231b2230046c648ba2f2c3f6ab6d21f6898a767d05aa8595d6aa37d53de51b32e02c82078b006b42

  • SSDEEP

    12288:mWc8Gpwi9AmfOechFXzBrRLoWMYdQQKlhTBXjp5wB2SzrBwVsJgD:O8INfgjxR3d/K7

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    smtp.almuntakhaba.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    amite123

Targets

    • Target

      0a2dd7c7f33945c9f8d0d572fdea8eb4

    • Size

      737KB

    • MD5

      0a2dd7c7f33945c9f8d0d572fdea8eb4

    • SHA1

      35eedbf87d0db7f098c164fa2dfd648023ea5ea8

    • SHA256

      c0351986edde88da74cc051c26fee9466569d49773c0984439d544037341bb6c

    • SHA512

      00622f3750d78d9197ba87b8578ebb38bb63fe6e6429cc75231b2230046c648ba2f2c3f6ab6d21f6898a767d05aa8595d6aa37d53de51b32e02c82078b006b42

    • SSDEEP

      12288:mWc8Gpwi9AmfOechFXzBrRLoWMYdQQKlhTBXjp5wB2SzrBwVsJgD:O8INfgjxR3d/K7

    Score
    10/10
    agentteslakeyloggerspywarestealertrojancollection

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla payload

    • Drops file in Drivers directory

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks