Overview

overview

10

Static

static

3

Total Invoices.exe

windows7-x64

10

Total Invoices.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    11fe7df03d81755d77e22853e843d4f4.bin

  • Size

    707KB

  • Sample

    240426-bdl9pagf2s

  • MD5

    04a30c7c1a70b8635cb4a362152c43df

  • SHA1

    e41b2f1ba72de878673f17204dadd4735ba16a91

  • SHA256

    2b00500da79ecddffab11f031a9d09b728a6f6bb9e9d9c3aba1a0996890016fa

  • SHA512

    ef011599c1e4be23e814d45f5a70a0f4953012a571a84a1f53f01d09987941c0e509286e9c81617da067bf86251f43be4efbf84bb772d2177e6cd30729c4ef56

  • SSDEEP

    12288:kn34q5ED75WYlCxt7BNLYXesfJSjfnPNAcpBcy1yf5OAb/8M+Y0p+7GvJw9d8+o2:k3xED1WYl+t7X4eMSjflAcpb1yDAJf+n

Score
10/10
agentteslakeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      Total Invoices.exe

    • Size

      789KB

    • MD5

      cd3c05ebb9a3fca7aa748f522559b1ea

    • SHA1

      43dc8cdf47186a54dc38cd86450aca6f6361a9b4

    • SHA256

      c96565623c3e405a370614f452383a763f5a48baf25e79f91a6311c9a0a8fd3a

    • SHA512

      5d11d8dbec417ed7c8bd9f2b49925c01440b4d517cff1190d411e832528550f0e6645c7005dbd0953aafb82ba7d25977351f0ad5aba5736bd62140a3d0cc2e6a

    • SSDEEP

      24576:7ldr5ja9fm5r+jrZf1vsAJ2jN5GFhXuv:7lbjH5srZtvXouj

    Score
    10/10
    agentteslakeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks