Overview

overview

10

Static

static

5

vsl_inform...df.exe

windows7-x64

10

vsl_inform...df.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    vsl_information_7927_pdf.exe

  • Size

    1.0MB

  • Sample

    240515-j929sagh97

  • MD5

    67950946282eae4057d8175b41604764

  • SHA1

    34abefea5eed13529b243e06f87d14977081b295

  • SHA256

    fb4919294389e873ecbf846b77f281854cc9e15cebb095fc4c54cd7c55c0ee9e

  • SHA512

    65b7e6eaed0c5582b741293661447e35ec84c14170f9512de24987e03f26cbfb295d882c13c7ff4eea7af3cd0fb7f1cf003f7d8b5f255e0ed68b571996e104b5

  • SSDEEP

    24576:OAHnh+eWsN3skA4RV1Hom2KXMmHaoZUakf8wh5:5h+ZkldoPK8Yao+aIn

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      vsl_information_7927_pdf.exe

    • Size

      1.0MB

    • MD5

      67950946282eae4057d8175b41604764

    • SHA1

      34abefea5eed13529b243e06f87d14977081b295

    • SHA256

      fb4919294389e873ecbf846b77f281854cc9e15cebb095fc4c54cd7c55c0ee9e

    • SHA512

      65b7e6eaed0c5582b741293661447e35ec84c14170f9512de24987e03f26cbfb295d882c13c7ff4eea7af3cd0fb7f1cf003f7d8b5f255e0ed68b571996e104b5

    • SSDEEP

      24576:OAHnh+eWsN3skA4RV1Hom2KXMmHaoZUakf8wh5:5h+ZkldoPK8Yao+aIn

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks