Overview

overview

10

Static

static

3

Arrival Notice.exe

windows7-x64

10

Arrival Notice.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Arrival Notice.r09

  • Size

    597KB

  • Sample

    240125-v4yj7acfel

  • MD5

    d98e4a4cbaa8ec3ee8c009b73f5aee4f

  • SHA1

    f99d9d892e8acaa6ed3d122503bd1dcbebf5db44

  • SHA256

    36484e70d703243720d4d8170e8bd708c59a879256ff70413b2ab1f7267efd6a

  • SHA512

    c8af78a70fda421b9050ec62dc230c220d69c2ff479916f096fab2717382da1d692c6fcdc310631c84e6788b1310e6ef83ca604e7d40f5c9c8a9e2e48e345dba

  • SSDEEP

    12288:aDlvf9bO7SgGz+dLIzwE5FIRkBAuh7CZTfdFIDY8ZWkeMd1P2zGaCYoUE:GldYS3z+tSxMeBAupGfdFIWkeYP2u

Score
10/10
agentteslakinsingkeyloggerloaderspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      Arrival Notice.exe

    • Size

      632KB

    • MD5

      d5551d02842d0bca89645f6d2dcd9425

    • SHA1

      60e703ba9b877189f2a5349cae2512de050bc76c

    • SHA256

      558122a88015bea8cc58d92d22e752167ccf7d837d8d85a3070497471660de3a

    • SHA512

      a30a933775af324a4f6662288fa52ac8336d96cbbf44ca2ff9a40411ec2a4b6e2817b8372337bf1a1c18e476c3304a6e9bb8c8bcb4e7f44664de4af17d5670ae

    • SSDEEP

      12288:knJ+gIaWmooQ9gfWer8oDRGLndvQfaTGXc8YrN7n0x:GU9F9gfl8zBw/YrN7

    Score
    10/10
    agentteslakeyloggerspywarestealertrojankinsingloader

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Kinsing

      Kinsing is a loader written in Golang.

      loaderkinsing

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks