Overview

overview

10

Static

static

5

7ee8c32970...d4.exe

windows7-x64

10

7ee8c32970...d4.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7ee8c32970f34719127d9ed8087396dd00975d2b17186c1b1915385d246cdfd4.exe

  • Size

    1.0MB

  • Sample

    240522-cbdp7sgg8x

  • MD5

    5165e5022c628f4d08a5428b1d009dd4

  • SHA1

    2c63ec13ac0d1908065fccd7df99a7f7d0c18e71

  • SHA256

    7ee8c32970f34719127d9ed8087396dd00975d2b17186c1b1915385d246cdfd4

  • SHA512

    3d17b7492fe141a8ed2d2aa10bc0b5e7500d660dce3f06f818f271b098b9e0b250c4068419faea6a051ab708ef0c6b6a186fb7337cfacc04e8f561824adfb019

  • SSDEEP

    24576:0AHnh+eWsN3skA4RV1Hom2KXMmHaUA9ItV1ONS5:Dh+ZkldoPK8YaUA6tVb

Score
10/10
agentteslakeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      7ee8c32970f34719127d9ed8087396dd00975d2b17186c1b1915385d246cdfd4.exe

    • Size

      1.0MB

    • MD5

      5165e5022c628f4d08a5428b1d009dd4

    • SHA1

      2c63ec13ac0d1908065fccd7df99a7f7d0c18e71

    • SHA256

      7ee8c32970f34719127d9ed8087396dd00975d2b17186c1b1915385d246cdfd4

    • SHA512

      3d17b7492fe141a8ed2d2aa10bc0b5e7500d660dce3f06f818f271b098b9e0b250c4068419faea6a051ab708ef0c6b6a186fb7337cfacc04e8f561824adfb019

    • SSDEEP

      24576:0AHnh+eWsN3skA4RV1Hom2KXMmHaUA9ItV1ONS5:Dh+ZkldoPK8YaUA6tVb

    Score
    10/10
    agentteslakeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Detect packed .NET executables. Mostly AgentTeslaV4.

    • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

    • Detects executables referencing Windows vault credential objects. Observed in infostealers

    • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

    • Detects executables referencing many email and collaboration clients. Observed in information stealers

    • Detects executables referencing many file transfer clients. Observed in information stealers

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks