Overview

overview

10

Static

static

3

0b28435661...05.exe

windows7-x64

10

0b28435661...05.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    93da4f364deae0c5dccb3d9ab2e1c67a.bin

  • Size

    655KB

  • Sample

    240329-c5cd8sff3w

  • MD5

    6d2281e49d499d849a0f6f2d3457f27c

  • SHA1

    de7a2bbc3a36290d1d3e83886a712ca3c8d5df76

  • SHA256

    27f19e8d3fdadbd2e37b9a745a0143621c7cb2c1fcffa280f7942663917eb43e

  • SHA512

    c620df310e9cbeb7d7b2ed47bcd43db35494047d892bc66813aae501d60d251b818f00e2a707b47ce506ba25f6292599709ba361e05b5114025f6abcc566701e

  • SSDEEP

    12288:lNi886KwEy77D37837oH5QhTY9zgy/AddW1os4HXPKzI2zq3YuttrH0Bo:zzHz78roH+JYdAPuufKE6MHt4G

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

C2

https://discordapp.com/api/webhooks/1209079326381703258/KMWScJ3_PST6cUhH_FpNX9xquPQydoTw5ra7lQhfDovLGBW7jR_Rk634D6j1s1IOLj61

Targets

    • Target

      0b2843566112d9b4a879e77416227bb7c46152c418385d4e608b7d7b687dd305.exe

    • Size

      747KB

    • MD5

      93da4f364deae0c5dccb3d9ab2e1c67a

    • SHA1

      e65df8007dae4cddbb1119c7dcc0737328c760d7

    • SHA256

      0b2843566112d9b4a879e77416227bb7c46152c418385d4e608b7d7b687dd305

    • SHA512

      436a1a3fa33acb21ddc76d0191b204cf86a83ad587dfb9c97a0ae8d9e3bfa8602bc59162cbfdfdea57988151dcc386769d395fa81f3c7b87e55b9a8e650482b6

    • SSDEEP

      12288:TkMayww0KgdH8+WXfJxsXqmUUwyFT9kgwyXROOTa85gijVdIaNv:zajSQC/0we5kwROOTa85PjrNN

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks