Overview

overview

10

Static

static

3

c1cd476072...42.exe

windows7-x64

10

c1cd476072...42.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    c1cd4760729c2297023acb0fa90f5745086282c2cb53ada37ecba4384fa57242

  • Size

    696KB

  • Sample

    240307-b4g3nadh9x

  • MD5

    9c84d70768c3af6334b2b104f9ab06c7

  • SHA1

    0379c8682b3df052dc8edb6e5513900fda5fae83

  • SHA256

    c1cd4760729c2297023acb0fa90f5745086282c2cb53ada37ecba4384fa57242

  • SHA512

    02f06b97ede0e4c799caa4eb792f99eac770e2c906a00688443b5cf5b2b7407184a27ac1d519f2065d3ea1e0c924540f4d329567811220ad6d1e66a98e9a73b7

  • SSDEEP

    12288:1mDbZrwZ1AcMB2Dses+MweXSshUOlAlTet8O36Pwa2iN:aZTcM93+Yi6kTe6Z31

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      c1cd4760729c2297023acb0fa90f5745086282c2cb53ada37ecba4384fa57242

    • Size

      696KB

    • MD5

      9c84d70768c3af6334b2b104f9ab06c7

    • SHA1

      0379c8682b3df052dc8edb6e5513900fda5fae83

    • SHA256

      c1cd4760729c2297023acb0fa90f5745086282c2cb53ada37ecba4384fa57242

    • SHA512

      02f06b97ede0e4c799caa4eb792f99eac770e2c906a00688443b5cf5b2b7407184a27ac1d519f2065d3ea1e0c924540f4d329567811220ad6d1e66a98e9a73b7

    • SSDEEP

      12288:1mDbZrwZ1AcMB2Dses+MweXSshUOlAlTet8O36Pwa2iN:aZTcM93+Yi6kTe6Z31

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks