Overview

overview

10

Static

static

3

Play_Boy.exe

windows10-1703-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    Play_Boy.exe

  • Size

    1.8MB

  • Sample

    240224-xltvdsbe93

  • MD5

    1ccddd126990d9136db83b7e41f3b9d9

  • SHA1

    44d1696019f7568da81bb18afa49135fd6242205

  • SHA256

    9b2f4c2e08e912f5c09c8226d4b421e9f6cfba3c8ed0f2c984f8f76caac58384

  • SHA512

    a904eb330b159dd00a872c172735c0844d87fd403e58d617271ec525112ed9ea368f87c22c6de2529abd43370fe58f4fe0391b5a011a46d374dbfd63070e7164

  • SSDEEP

    49152:TiRQ91LnYITYbNbNWo4kSH3OqtwICw+W7SC:TiRQgIT4bNJFY3OqtR

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      Play_Boy.exe

    • Size

      1.8MB

    • MD5

      1ccddd126990d9136db83b7e41f3b9d9

    • SHA1

      44d1696019f7568da81bb18afa49135fd6242205

    • SHA256

      9b2f4c2e08e912f5c09c8226d4b421e9f6cfba3c8ed0f2c984f8f76caac58384

    • SHA512

      a904eb330b159dd00a872c172735c0844d87fd403e58d617271ec525112ed9ea368f87c22c6de2529abd43370fe58f4fe0391b5a011a46d374dbfd63070e7164

    • SSDEEP

      49152:TiRQ91LnYITYbNbNWo4kSH3OqtwICw+W7SC:TiRQgIT4bNJFY3OqtR

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks