Overview

overview

10

Static

static

3

eff673e5ff...4e.exe

windows7-x64

eff673e5ff...4e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    eff673e5ff24a753d775c93914d2468bd6bb51ec301115ff6f894f7917c37e4e

  • Size

    12.6MB

  • Sample

    240416-ck49hsgf9t

  • MD5

    828b92bff3093ae4a7de625ff52d4db9

  • SHA1

    22e4fd97c83e8693aeea7c62f0f58e59b3bfba5d

  • SHA256

    eff673e5ff24a753d775c93914d2468bd6bb51ec301115ff6f894f7917c37e4e

  • SHA512

    be7e08fb9af8cff2f8173876b87ab591cf094bcdbdfdb76ef52be24beb83882bc928f06a96ba4cd979fc51ab41c98369473d5bff767520615cc40c78efdbb6ed

  • SSDEEP

    196608:wblRO/sYnmyz4TmbLjR7CoK1D+aNOFpuKxDCpNsbw8GzN9iBl4TEatLkvjSMc:emmyz4TmN+oK1+HVefsbw8/oTLh

Score
10/10
agentteslaagilenetkeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      eff673e5ff24a753d775c93914d2468bd6bb51ec301115ff6f894f7917c37e4e

    • Size

      12.6MB

    • MD5

      828b92bff3093ae4a7de625ff52d4db9

    • SHA1

      22e4fd97c83e8693aeea7c62f0f58e59b3bfba5d

    • SHA256

      eff673e5ff24a753d775c93914d2468bd6bb51ec301115ff6f894f7917c37e4e

    • SHA512

      be7e08fb9af8cff2f8173876b87ab591cf094bcdbdfdb76ef52be24beb83882bc928f06a96ba4cd979fc51ab41c98369473d5bff767520615cc40c78efdbb6ed

    • SSDEEP

      196608:wblRO/sYnmyz4TmbLjR7CoK1D+aNOFpuKxDCpNsbw8GzN9iBl4TEatLkvjSMc:emmyz4TmN+oK1+HVefsbw8/oTLh

    Score
    10/10
    agilenetagentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks