Overview

overview

10

Static

static

3

Total Invoices.exe

windows7-x64

10

Total Invoices.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Total Invoices.7z

  • Size

    707KB

  • Sample

    240424-r2z4fsbg7y

  • MD5

    11fe7df03d81755d77e22853e843d4f4

  • SHA1

    23dc63bf9fc9a92c300de638cd985d9142fd377a

  • SHA256

    026d2e47c24fcbf324fb2985ebff0009597f811abdbf8cb85b366a5e8b720e39

  • SHA512

    eb8932013e19dc8c735016b748dff1e8d02fa3aa1eaeddd778197acf55034b00bcae3f849649720548342ecd97ea6b6a27e51a825f36a5e7d964684cfe792eb2

  • SSDEEP

    12288:F+NJ5NyLdVK7S5AfvpknVVENpXCuSE5KroOHDAyJQTf1v3CsAJ2jOwP/ggfdE67a:INMBg7S5uanGmvrZjOTf1vHAJ2jO4goE

Score
10/10
agentteslakeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      Total Invoices.exe

    • Size

      789KB

    • MD5

      cd3c05ebb9a3fca7aa748f522559b1ea

    • SHA1

      43dc8cdf47186a54dc38cd86450aca6f6361a9b4

    • SHA256

      c96565623c3e405a370614f452383a763f5a48baf25e79f91a6311c9a0a8fd3a

    • SHA512

      5d11d8dbec417ed7c8bd9f2b49925c01440b4d517cff1190d411e832528550f0e6645c7005dbd0953aafb82ba7d25977351f0ad5aba5736bd62140a3d0cc2e6a

    • SSDEEP

      24576:7ldr5ja9fm5r+jrZf1vsAJ2jN5GFhXuv:7lbjH5srZtvXouj

    Score
    10/10
    agentteslakeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks