Overview

overview

10

Static

static

3

6227a5500d...23.exe

windows7-x64

1

6227a5500d...23.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6227a5500df53be8c94473aaed2479610329568b55142ca56120c94f9c0dd323.exe

  • Size

    888KB

  • Sample

    240430-btawlagf9y

  • MD5

    7c5508484d8b61155b13bb8476fb5f70

  • SHA1

    ab2be33782022e9f04dcbe25633d5c362193ecf3

  • SHA256

    6227a5500df53be8c94473aaed2479610329568b55142ca56120c94f9c0dd323

  • SHA512

    7245fe40ba2ae2f81ac956b71b9962eee64382e3171da3f4d55a9748ee992ee3c861d02712d5aa0f04155146879a58d6bee966dd5e638d413593b26d2ecf9643

  • SSDEEP

    24576:2wGf9bYNj0WU66TcnohHWJxpyz+epkQ4/Kh9YX3:A6OWU6dUoxpy14/KUH

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      6227a5500df53be8c94473aaed2479610329568b55142ca56120c94f9c0dd323.exe

    • Size

      888KB

    • MD5

      7c5508484d8b61155b13bb8476fb5f70

    • SHA1

      ab2be33782022e9f04dcbe25633d5c362193ecf3

    • SHA256

      6227a5500df53be8c94473aaed2479610329568b55142ca56120c94f9c0dd323

    • SHA512

      7245fe40ba2ae2f81ac956b71b9962eee64382e3171da3f4d55a9748ee992ee3c861d02712d5aa0f04155146879a58d6bee966dd5e638d413593b26d2ecf9643

    • SSDEEP

      24576:2wGf9bYNj0WU66TcnohHWJxpyz+epkQ4/Kh9YX3:A6OWU6dUoxpy14/KUH

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Detect packed .NET executables. Mostly AgentTeslaV4.

    • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

    • Detects executables packed with or use KoiVM

    • Detects executables referencing Windows vault credential objects. Observed in infostealers

    • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

    • Detects executables referencing many email and collaboration clients. Observed in information stealers

    • Detects executables referencing many file transfer clients. Observed in information stealers

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks