Overview

overview

10

Static

static

5

934ac4a997...c9.exe

windows7-x64

10

934ac4a997...c9.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    934ac4a9970ecd96698d4ddb640e2fa7033def86872c50661b7d787d064914c9

  • Size

    1.1MB

  • Sample

    240330-bezleaec64

  • MD5

    7ebed467527f97a540ec04925df583cd

  • SHA1

    e9522ceaf4881a24dafe22d99fce27b6c3621947

  • SHA256

    934ac4a9970ecd96698d4ddb640e2fa7033def86872c50661b7d787d064914c9

  • SHA512

    f1e58cce229a707d2f41e037e9b42c87c3313817a2e1290258b3d9dcfc8171e7a225ce9b36bd93106cdbda810787c2f4dc612de39b77d543ea93312e7c7a318c

  • SSDEEP

    24576:sqDEvCTbMWu7rQYlBQcBiT6rprG8ahU0zg1Tx:sTvC/MTQYxsWR7ah

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot6776344622:AAE2QGMduuZ12VrNAxC91B7E3v-RBpjCMNI/

Targets

    • Target

      934ac4a9970ecd96698d4ddb640e2fa7033def86872c50661b7d787d064914c9

    • Size

      1.1MB

    • MD5

      7ebed467527f97a540ec04925df583cd

    • SHA1

      e9522ceaf4881a24dafe22d99fce27b6c3621947

    • SHA256

      934ac4a9970ecd96698d4ddb640e2fa7033def86872c50661b7d787d064914c9

    • SHA512

      f1e58cce229a707d2f41e037e9b42c87c3313817a2e1290258b3d9dcfc8171e7a225ce9b36bd93106cdbda810787c2f4dc612de39b77d543ea93312e7c7a318c

    • SSDEEP

      24576:sqDEvCTbMWu7rQYlBQcBiT6rprG8ahU0zg1Tx:sTvC/MTQYxsWR7ah

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks