Overview

overview

10

Static

static

1

payment co...on.exe

windows7-x64

10

payment co...on.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    mail.eml

  • Size

    984KB

  • Sample

    240501-pdwd9aee6t

  • MD5

    72b860a848daa139a1349c47e2a36ce1

  • SHA1

    3aac7bc3470254acd8cdf6ba42ea8f881ecc9b14

  • SHA256

    28eb0908dfbbc9d3db643f27aa5052ccf631179df851eef32ad96b3054b799e5

  • SHA512

    ec7051aa19a1f27236be0ca89e2b699d14dae13a90e50a8c56e55dfb0e8c35242f2a37d6e1234ee7392e47858eb82b47fe8fe2aced66d7278424105cadb8112d

  • SSDEEP

    24576:hBR+mVFIlGfu7Peaw0VYjr5ZSPn/vhLjNJV2AUulc:jHFIZ00Y5ZM5NSAUMc

Score
10/10
agentteslakeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      payment confirmation.exe

    • Size

      807KB

    • MD5

      fea84a2a79e39deb22b64d9431263fa4

    • SHA1

      b233547650120b9b0d4327b355fff6d198c88aae

    • SHA256

      41dc02abba1fa20676b50eeb403f735dff2eb2a2223fa1469a4a5f7d470f77b7

    • SHA512

      1dd6a150a9332f7e206c8556642b81678dbf1cd4ba3690daed9b5c1e362eafe73450a9aa2119d754185cf7ae7cb32aded37324f5d846463d8decc5b0b9fd9ed5

    • SSDEEP

      24576:orA4MtlrmVpJEABpkkUTib2K96C8fnl4c7g7NOctO1P:CCtmpJEH/TjQAvl4l9ON

    Score
    10/10
    agentteslakeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks