Overview

overview

10

Static

static

5

2a8cbc9a8a...c1.exe

windows7-x64

10

2a8cbc9a8a...c1.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    2a8cbc9a8a0a75b7fb4f73aa3fbfbfbe04442f64408bf20a34b910507568ccc1

  • Size

    1.3MB

  • Sample

    240408-yehn8aaa29

  • MD5

    d3abb61ea61684986a8b34d5319296f8

  • SHA1

    ea4c0751cdd1be7566d5e4644c54545e7d0cf7e2

  • SHA256

    2a8cbc9a8a0a75b7fb4f73aa3fbfbfbe04442f64408bf20a34b910507568ccc1

  • SHA512

    32debaf9bd2b9fee3c729aa4ce49c24a7c723cc5c725495e4838bacdb67ef9f7c710646ab41076b1f314bb6d8268757cf1f06ef2b4dac7b4cfb9b54c53622a32

  • SSDEEP

    24576:dAHnh+eWsN3skA4RV1Hom2KXMmHaoNMvgQot/vo6bf6fOGTJkPx5:8h+ZkldoPK8Yao+vghZ6fOgJ0

Score
10/10
agentteslacollectionkeyloggerpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      2a8cbc9a8a0a75b7fb4f73aa3fbfbfbe04442f64408bf20a34b910507568ccc1

    • Size

      1.3MB

    • MD5

      d3abb61ea61684986a8b34d5319296f8

    • SHA1

      ea4c0751cdd1be7566d5e4644c54545e7d0cf7e2

    • SHA256

      2a8cbc9a8a0a75b7fb4f73aa3fbfbfbe04442f64408bf20a34b910507568ccc1

    • SHA512

      32debaf9bd2b9fee3c729aa4ce49c24a7c723cc5c725495e4838bacdb67ef9f7c710646ab41076b1f314bb6d8268757cf1f06ef2b4dac7b4cfb9b54c53622a32

    • SSDEEP

      24576:dAHnh+eWsN3skA4RV1Hom2KXMmHaoNMvgQot/vo6bf6fOGTJkPx5:8h+ZkldoPK8Yao+vghZ6fOgJ0

    Score
    10/10
    agentteslacollectionkeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla payload

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks