Overview

overview

10

Static

static

3

53c826ee41...68.exe

windows7-x64

10

53c826ee41...68.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    53c826ee416baebb2d73add7056203ec3147c400f13fa8c1f025e2437aab8b68

  • Size

    187KB

  • Sample

    240118-bxl32aabhn

  • MD5

    013e8e19e4328d222482235a1835b29d

  • SHA1

    93349642b19fc317ceee44198114859b301c411b

  • SHA256

    53c826ee416baebb2d73add7056203ec3147c400f13fa8c1f025e2437aab8b68

  • SHA512

    81bed92d4abe364e2e1fa6d6e6d6bfbc08eebcd0baa6fe1706791bb7c548d0f16561801ca8e29819a782c6e321bd0ce651282dc6d28df2e0a293feb76e89d7df

  • SSDEEP

    3072:kn8Ym0oaRkMYeFW1EjrMdCIHLCbQYpSFPV2ZcF1nzJLXOyYiUxcAOq9OPbavq6p7:YU86eCoAdXLEFtvq61f

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.cornery.com.my
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Market321*

Targets

    • Target

      53c826ee416baebb2d73add7056203ec3147c400f13fa8c1f025e2437aab8b68

    • Size

      187KB

    • MD5

      013e8e19e4328d222482235a1835b29d

    • SHA1

      93349642b19fc317ceee44198114859b301c411b

    • SHA256

      53c826ee416baebb2d73add7056203ec3147c400f13fa8c1f025e2437aab8b68

    • SHA512

      81bed92d4abe364e2e1fa6d6e6d6bfbc08eebcd0baa6fe1706791bb7c548d0f16561801ca8e29819a782c6e321bd0ce651282dc6d28df2e0a293feb76e89d7df

    • SSDEEP

      3072:kn8Ym0oaRkMYeFW1EjrMdCIHLCbQYpSFPV2ZcF1nzJLXOyYiUxcAOq9OPbavq6p7:YU86eCoAdXLEFtvq61f

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks