Overview

overview

10

Static

static

3

226350194-...64.exe

windows7-x64

10

226350194-...64.exe

windows10-2004-x64

3

Resubmissions

07/03/2024, 13:28

240307-qqq6qscc69 8

07/03/2024, 13:25

240307-qn4n2scb92 10

07/03/2024, 13:21

240307-qlz8vada91 10

07/03/2024, 13:21

240307-qlp3waca83 3

Sharing

Copy URL Twitter E-mail

General

  • Target

    attachments.zip

  • Size

    488KB

  • Sample

    240307-qn4n2scb92

  • MD5

    660bace33a1309cfed1eb9007b730268

  • SHA1

    672eef78e9814eb450e8b74dc7e78e2ae96e2a21

  • SHA256

    3b530ace3209771f676e361ebc54dfc5d992d5069db93d416cd4b60745ccc400

  • SHA512

    e403b6ab351d464a173dc42011ed20883867247ba81e77e5643d3d7a4de635e14c927495f6944c1960a62fc63615fb6b6824d88b310f43848f74988257159222

  • SSDEEP

    12288:WmDS22BY1Piq7p19SWp1vF1tZkCZNidsiu5kNMr2K1WqGvbL:WmcBY4q7p1971vNo07r2K1kbL

Score
10/10
agentteslaguloaderdownloaderkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot5147163644:AAEDa60jT_0f_OgilwiEp-CBiARVO2Rx3Mo/

Targets

    • Target

      226350194-050944-sanlccjavap0003-11764.exe

    • Size

      626KB

    • MD5

      0d4bb5c57ce0f99b36056892cfe87f0c

    • SHA1

      bd884e9d666bce68ef23dfa139f6477f1c50f7ab

    • SHA256

      0301d446fd70d25f294abb066b139bdc8d5362f86d9d10ae4c5ed13e7e6f311c

    • SHA512

      7d404dc721e4eb51f91956b96d3864ae2d2cc9e8c8464d446abf087b84466230ddea2662107b5d192369e8b2211b3616025628dc07f4eb679676144915dcaf6e

    • SSDEEP

      12288:RhKVcnRerrRiJJGDktgdRYCryyqmsufs5BKGR9YWYn+4t8w:REGnReZeJGDikBrLqmZgBKgPKnt/

    Score
    10/10
    agentteslaguloaderdownloaderkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks