Overview

overview

10

Static

static

5

SQ468009.exe

windows7-x64

10

SQ468009.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    30fdbc484316bef291f699894737fe9b25ade8adfdd8b1bd43241dbc24e181d3

  • Size

    604KB

  • Sample

    240312-bqwc5abg9z

  • MD5

    87e0408c472a779e9ffba3f9639afb4e

  • SHA1

    3f6a21671f87a81ba94c3a548737971e6f4c3388

  • SHA256

    30fdbc484316bef291f699894737fe9b25ade8adfdd8b1bd43241dbc24e181d3

  • SHA512

    8a09b1366dd01261dba0461daf7d01c5c413011f497b9fc8d7828a9d97ada68e5670bfe8dc54cb6e8b00fc026a9d90d85763883f21d5a7a7d665f581894a45d8

  • SSDEEP

    12288:FxtLJ0wFCtCgWSkGMDEEFegHUmUwV5egDktL9nt1BnrBPLZ:FxtLJNUpWSkGMDJFegHk0DgJT1Bn1Z

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.awelleh3.top
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    QcR_(8@AdfHa

Targets

    • Target

      SQ468009.exe

    • Size

      1.0MB

    • MD5

      dea8d7d306e05cfd3d282e924f35b5a5

    • SHA1

      fd043cb3a1a4cff21a3ade38fedbb0c39ebe95f6

    • SHA256

      9fe2f9d02da8b03d4a01909fd04939bbdf8f5cecbf4a9a3c38253f93fb6c1cf9

    • SHA512

      abad3552cc6429bf72dd8e743e2b77b44a50bbfa0ad0fba2672bb16841c89e398ff776a2a928686f7a4fdc1d521121abb121e14292a3122b630316175e7ff76f

    • SSDEEP

      24576:nAHnh+eWsN3skA4RV1Hom2KXMmHaNj0dC/FLR5:ah+ZkldoPK8YaNj7

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks