Overview

overview

10

Static

static

3

eb158b84b4...2d.exe

windows7-x64

10

eb158b84b4...2d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    eb158b84b430ad7f4b4e179f7b8742fa97c2c2129a0cba06039225fa4acc5a2d

  • Size

    760KB

  • Sample

    240329-b6ys7aec5z

  • MD5

    ed69417115869e40733f265fd489a56f

  • SHA1

    eb88646dd13188207ca09c7a448b6b16942222c4

  • SHA256

    eb158b84b430ad7f4b4e179f7b8742fa97c2c2129a0cba06039225fa4acc5a2d

  • SHA512

    4f487a83a33700f0d434ebb6d29bc9027710b0eb7f1b72e0ba5210e66f3198ce5bf2060cf2794e9f2b11f0342ad07bdf36ff7a744296027ab6ad0df53ea05f25

  • SSDEEP

    12288:kR0YOwq7tzRznULWLtcMPZCB5SYtDNinCgG8n5l9AwRFYWXup+:knO7jQLWLtcMBkSaDMCt8n5lSwYWq+

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      eb158b84b430ad7f4b4e179f7b8742fa97c2c2129a0cba06039225fa4acc5a2d

    • Size

      760KB

    • MD5

      ed69417115869e40733f265fd489a56f

    • SHA1

      eb88646dd13188207ca09c7a448b6b16942222c4

    • SHA256

      eb158b84b430ad7f4b4e179f7b8742fa97c2c2129a0cba06039225fa4acc5a2d

    • SHA512

      4f487a83a33700f0d434ebb6d29bc9027710b0eb7f1b72e0ba5210e66f3198ce5bf2060cf2794e9f2b11f0342ad07bdf36ff7a744296027ab6ad0df53ea05f25

    • SSDEEP

      12288:kR0YOwq7tzRznULWLtcMPZCB5SYtDNinCgG8n5l9AwRFYWXup+:knO7jQLWLtcMBkSaDMCt8n5lSwYWq+

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks