Overview

overview

10

Static

static

5

ba0079e362...61.exe

windows7-x64

10

ba0079e362...61.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ba0079e362dd8ceea7e8458a3cc013911937901c00b82c864c5df80f1af3bd61

  • Size

    1.1MB

  • Sample

    240330-beyzwaec63

  • MD5

    eff012f15960034972b2487cd28c16b8

  • SHA1

    18c9a4f14975c900de57be563995922e498ead91

  • SHA256

    ba0079e362dd8ceea7e8458a3cc013911937901c00b82c864c5df80f1af3bd61

  • SHA512

    00139bff82f665ed531fe098ca34e0cf4d32b9a480d90e60572de29b1dded8d646e972e5c4aa3003362fba2c942b022ee561da4ae53f7b25cb6fb12751e5f1cf

  • SSDEEP

    24576:BqDEvCTbMWu7rQYlBQcBiT6rprG8a5dVyAl4ZK:BTvC/MTQYxsWR7a5hl4

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      ba0079e362dd8ceea7e8458a3cc013911937901c00b82c864c5df80f1af3bd61

    • Size

      1.1MB

    • MD5

      eff012f15960034972b2487cd28c16b8

    • SHA1

      18c9a4f14975c900de57be563995922e498ead91

    • SHA256

      ba0079e362dd8ceea7e8458a3cc013911937901c00b82c864c5df80f1af3bd61

    • SHA512

      00139bff82f665ed531fe098ca34e0cf4d32b9a480d90e60572de29b1dded8d646e972e5c4aa3003362fba2c942b022ee561da4ae53f7b25cb6fb12751e5f1cf

    • SSDEEP

      24576:BqDEvCTbMWu7rQYlBQcBiT6rprG8a5dVyAl4ZK:BTvC/MTQYxsWR7a5hl4

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks