Overview

overview

10

Static

static

3

Springhill...mg.exe

windows7-x64

10

Springhill...mg.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    d933840f4eab2f54bb39b15b97cf8a8509e1f8b6fe35b6bcbe3066bd6d7f6836

  • Size

    852KB

  • Sample

    240416-b8kz4see24

  • MD5

    fc14ff92f92c45243ab6a4ed403d6888

  • SHA1

    cc4200fd72c58d08d04973111a169ce5fc02d2b8

  • SHA256

    d933840f4eab2f54bb39b15b97cf8a8509e1f8b6fe35b6bcbe3066bd6d7f6836

  • SHA512

    34f0ccdc95100881c897b93ca9ffacdd773bf20f0c07353b32fb94f73f765693b71726011112634d410a2c34e29dc7536c4bdc93ea470c13b7c6c4e51953eda0

  • SSDEEP

    24576:AKqOIOm2QUBss6SykABzfytOyqQV9FcnmY9:sz/2QUBss6SykAgtOyqQV9Cnz9

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      Springhill Textile Ab- GAW24-46 img.exe

    • Size

      1.0MB

    • MD5

      71b5da5a28e71e5071becfe9b149f8ac

    • SHA1

      9788d70b6efad78c9c159553296eae40daf90153

    • SHA256

      3e6c0c4d3f37780d6cc07d9b57d36c74fc8de02d13e05ea51fca7b815cde8d59

    • SHA512

      05079c1406bb1062d55ab9a013669253a6f589b0c6678e4336bc9bac64871ee41fd42dc802b69b1266d9385742b0674543dc075ea609a33a8ec23f9fc9ef63b1

    • SSDEEP

      24576:h1qwOISG22mBss0Sykah91O7OyEQtr3cnmiS:ywzD22mBss0SykaY7OyEQtrMn7S

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks