Overview

overview

10

Static

static

3

a9fa586fb6...c6.exe

windows7-x64

10

a9fa586fb6...c6.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a9fa586fb62d05caf2175e13fc20c8cb245d4902961bb833c8792befd5e7b0c6.exe

  • Size

    772KB

  • Sample

    240425-t345xacf2v

  • MD5

    0f0ee25a8b1b5211183bc818ecdf422f

  • SHA1

    edf0d85083e1cc9e0053833005d9e3a630955377

  • SHA256

    a9fa586fb62d05caf2175e13fc20c8cb245d4902961bb833c8792befd5e7b0c6

  • SHA512

    2618b1f7aff7b62448d7e75aaa413e0e22e2ebf3c8d7c762ed534e6a1faa0d5c07cbb7d8e4aaecc24ff5768e2eb2eb07d6b06b16ffba6f007772f7427f60d03f

  • SSDEEP

    24576:CF1KSdrnKceUoI6qB26yaDPm0tCphRNtJkJ312Zx:sQOrKceUfVs0tCphRNtJkJl2T

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      a9fa586fb62d05caf2175e13fc20c8cb245d4902961bb833c8792befd5e7b0c6.exe

    • Size

      772KB

    • MD5

      0f0ee25a8b1b5211183bc818ecdf422f

    • SHA1

      edf0d85083e1cc9e0053833005d9e3a630955377

    • SHA256

      a9fa586fb62d05caf2175e13fc20c8cb245d4902961bb833c8792befd5e7b0c6

    • SHA512

      2618b1f7aff7b62448d7e75aaa413e0e22e2ebf3c8d7c762ed534e6a1faa0d5c07cbb7d8e4aaecc24ff5768e2eb2eb07d6b06b16ffba6f007772f7427f60d03f

    • SSDEEP

      24576:CF1KSdrnKceUoI6qB26yaDPm0tCphRNtJkJ312Zx:sQOrKceUfVs0tCphRNtJkJl2T

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks