Overview

overview

10

Static

static

3

PO 20240105.exe

windows7-x64

10

PO 20240105.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ac56e339e6b154f878813d46a579c4e1.bin

  • Size

    655KB

  • Sample

    240329-dmjahagb81

  • MD5

    a295e32d91b6f9acd6125710d7f8b717

  • SHA1

    9e1f747aaf6cbfa77564bebd82dfc2d8cacdf52b

  • SHA256

    a52edabcf224384b481e41f0076e869f470cd0c7e6b34dab11deab9d9eb94368

  • SHA512

    4bbfe45e1dca94bc6ffc434096c1a27ce619a3395e7fa5df1e344d10624b1bea300b08083d8c7f4a653bf03325af8c95f85cdf4f149981519f6e6a9e15579f28

  • SSDEEP

    12288:GD3IGNGZ5YoPOLoS7KZ1RNpQP61BQTjb6jpri7cqtklFTLXWLnPpG:Y3xNaKSqoDZ15QPoBIjcpu73WlFOLhG

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      PO 20240105.exe

    • Size

      740KB

    • MD5

      81d099f1008d98346919c22f105e26e5

    • SHA1

      de77e686d32adca574703621974811dc6c7d3b31

    • SHA256

      1ddead5d6964c8e382d3b2ea694774ff58486bcfb7996015561cc9a03c61b536

    • SHA512

      b174aa74461edcc8afee22134084d6de4001fdf5d7012fbcd904f119d3959d776b43fd91a25147c20d2dcfa0d18eeb0b554155d2c7380d55030e6dd2e28bf794

    • SSDEEP

      12288:Wd1JsJ6SH1Sh2iNwCZDcTsTmmk82Zzl2VLlh5AMOYFC6Vljc4J+G30NuqDpfLpPd:Wd4w1GQQABk1Zzl4ph5vtCi0hBDpfLG

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks