Overview

overview

10

Static

static

3

BirikimOzeti.pdf.exe

windows7-x64

10

BirikimOzeti.pdf.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8c105456ff94dd246a43b2954996673e244c733d3fb31404237f3b2ff17b7a55

  • Size

    1.3MB

  • Sample

    240522-cpwsyahb26

  • MD5

    59791d1defd53b03f8985d1af04a8369

  • SHA1

    27f2281f0fbd0a957d24f9eaa17f2c5496de95e5

  • SHA256

    8c105456ff94dd246a43b2954996673e244c733d3fb31404237f3b2ff17b7a55

  • SHA512

    dd4ac163a91f4ccd8139f6180c990af160b4391dad340a49472f2e34c89c91f58d3371b6caed51723b0b04e3db8d25be4fcb2e60bd9f5b2ed35929c2cda23dd8

  • SSDEEP

    24576:MpM1vIFZ1wOCniZQHX9lk/CH9d3afMioTpRN7urJ+7q32aAG19z:Mp9FcnioCfMpnu1OI2FG1F

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot7043330881:AAFq19dRSS-89_wbwEvbuucof5Z3tCHG2NY/

Targets

    • Target

      BirikimOzeti.pdf.exe

    • Size

      2.5MB

    • MD5

      7a8ade6c609d2f731d49edcbea8a4460

    • SHA1

      db3c54e7561245ab9865c28489b1e7a1a16ba68b

    • SHA256

      d353138e99ad05f11aaeaae203422d68ea012ae6d5efd50d338ad7db03efc92c

    • SHA512

      c364de20a44bfa6c1b22997ef69c0f3cb53a319b368fae55c1ae6123fc563b984c9a8a76b0efcb5fbf97970c3822242c823637639a79719b42183d3a6eb72c10

    • SSDEEP

      49152:9P6hSrcCPT0J+Lg31+mYGnKDATX7i2xG+:eujBmYGnKDATG2x5

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks