Overview

overview

10

Static

static

3

PO55AB023.exe

windows7-x64

10

PO55AB023.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PO55AB023.exe

  • Size

    992KB

  • Sample

    240429-lesszafb79

  • MD5

    1b42e1376d0825a28605891e6440f8d6

  • SHA1

    aa74269d844c2afac53a9daef3a76be40ec9602a

  • SHA256

    0e412b9c0758edef5114ed627e60c09f4df2108942becdcaa3bc1cb30e439223

  • SHA512

    3cc86e35999ad84f6cb9537879aac88575ff88cf6a3eaaf994c29d0045191d288d6e14cac6052508949847a21973bcbd1cb512c067810c354cdfd9004acfb31b

  • SSDEEP

    12288:TToPWBv/cpGrU3yUVC4sM+ExNlX+L6ZJgHflbsEGa6mbE0cyiXNJYnAorZFYrSg2:TTbBv5rUDAbVkNi/lbFGa6mPcyGJmA2

Score
10/10
agentteslakeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      PO55AB023.exe

    • Size

      992KB

    • MD5

      1b42e1376d0825a28605891e6440f8d6

    • SHA1

      aa74269d844c2afac53a9daef3a76be40ec9602a

    • SHA256

      0e412b9c0758edef5114ed627e60c09f4df2108942becdcaa3bc1cb30e439223

    • SHA512

      3cc86e35999ad84f6cb9537879aac88575ff88cf6a3eaaf994c29d0045191d288d6e14cac6052508949847a21973bcbd1cb512c067810c354cdfd9004acfb31b

    • SSDEEP

      12288:TToPWBv/cpGrU3yUVC4sM+ExNlX+L6ZJgHflbsEGa6mbE0cyiXNJYnAorZFYrSg2:TTbBv5rUDAbVkNi/lbFGa6mPcyGJmA2

    Score
    10/10
    agentteslakeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks