Overview

overview

10

Static

static

3

4bed889b70...11.exe

windows7-x64

10

4bed889b70...11.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4bed889b7068d487b6723f509ce367fa745ec3c7bfc6f028084bee179f1e7d11.exe

  • Size

    1.3MB

  • Sample

    240522-bx7dzagc61

  • MD5

    0034b9951f2ba9cd8b5c3355c302a459

  • SHA1

    4ef81deb3d7b87cfe6740c8eb057bd81f8693541

  • SHA256

    4bed889b7068d487b6723f509ce367fa745ec3c7bfc6f028084bee179f1e7d11

  • SHA512

    c3bdae67c74b0c1a2868ca493504037b9e65b080bdfe3347f148a2870f88fefcd4ebf13bc50910f889d1693c0fbf95be2854dc1c42bd8a959c3ae61d999eef51

  • SSDEEP

    24576:0MQFj+RDVIB+q8WVNIH6s5KZMhLV757v5ro4WvIKkQSNTJLOA5Is7pF4vChl:8BzqhLV7rozw5lOAtpe2

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.bellstone.in
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Sai54231!@# , .

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      4bed889b7068d487b6723f509ce367fa745ec3c7bfc6f028084bee179f1e7d11.exe

    • Size

      1.3MB

    • MD5

      0034b9951f2ba9cd8b5c3355c302a459

    • SHA1

      4ef81deb3d7b87cfe6740c8eb057bd81f8693541

    • SHA256

      4bed889b7068d487b6723f509ce367fa745ec3c7bfc6f028084bee179f1e7d11

    • SHA512

      c3bdae67c74b0c1a2868ca493504037b9e65b080bdfe3347f148a2870f88fefcd4ebf13bc50910f889d1693c0fbf95be2854dc1c42bd8a959c3ae61d999eef51

    • SSDEEP

      24576:0MQFj+RDVIB+q8WVNIH6s5KZMhLV757v5ro4WvIKkQSNTJLOA5Is7pF4vChl:8BzqhLV7rozw5lOAtpe2

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Detect packed .NET executables. Mostly AgentTeslaV4.

    • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

    • Detects executables packed with or use KoiVM

    • Detects executables referencing Windows vault credential objects. Observed in infostealers

    • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

    • Detects executables referencing many email and collaboration clients. Observed in information stealers

    • Detects executables referencing many file transfer clients. Observed in information stealers

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks