Overview

overview

10

Static

static

3

document.exe

windows7-x64

10

document.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    document.r15.rar

  • Size

    647KB

  • Sample

    240408-mr866afc28

  • MD5

    1651bf37301526e942825cd87af7fe05

  • SHA1

    4774e1b3f383c14c6f99fae2dcd3e87a14a4d216

  • SHA256

    33b5fcc64da827477e0a6c0be46cba8e5a43a9707a936830c9a72d215b654cbb

  • SHA512

    b40600c883a7517a992e4c542e0cb96796a93792c0c239f46df2fa44fde80f134fe448c31955b26d7263aa6ebabc9af2ebc18ae001d2eb7787736972aa5fae8c

  • SSDEEP

    12288:LsdWTztCX8nVL/xW8jDdRtszcxO0d60ls6CgJ6npRb0WUFg2STJggj7usoF:lHt4eV9tj1fdTpJApRLG87cF

Score
10/10
agentteslakeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      document.exe

    • Size

      677KB

    • MD5

      16840755455640657de48aa81c0f5247

    • SHA1

      4b64f121ed06741bb1a36f023beb7a10e26d0b27

    • SHA256

      f064387ab391aff2b0d120df58a0a98e269843462aca86076a9cb113885bd2cc

    • SHA512

      ed171d8af700f10e63577297c2626a0de99e0099c2a2c58b45731e0255aa923ac5e0b66dff6df28ffdf05b8b7d4cdc403dc74782f9efa5bda6dfb80b377df38b

    • SSDEEP

      12288:aFIB1oVeon3X8hq7WyqJoZnglXHQAM8vj4sbROgnSu2yqfbXxko7EF:aFqo53Mhq7WyqOnK3QkROGbZqjHi

    Score
    10/10
    agentteslakeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks