Overview

overview

10

Static

static

1

658e2f44c6...4c.exe

windows7-x64

10

658e2f44c6...4c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    658e2f44c6e3a6af989069dc2fc82337c326fe751e037161e1c780c9bc639c4c

  • Size

    763KB

  • Sample

    240522-cwlljshd39

  • MD5

    7dfb952c184cd0e1d8ad2df971a83986

  • SHA1

    a3d2cf69513c7d7ddd020eb11ad40c5ee790fd28

  • SHA256

    658e2f44c6e3a6af989069dc2fc82337c326fe751e037161e1c780c9bc639c4c

  • SHA512

    be9a46365483bdb02751fa4237e08685b3184b23d93f99b039a3f66a0496feeeb8a83ba2cf37a25fda7ca701d44f36f1fd834893be1fdd55d966d360d35ca77c

  • SSDEEP

    12288:yz+I6yWn7fcpVZlu/6uH30nEZ+ym9ENATN9O/P8xGkFp+DjwT8rHDFXVz4X6YG1y:/I698VVY30nEB09YEGkx47hlznI

Score
10/10
agentteslaexecutionkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      658e2f44c6e3a6af989069dc2fc82337c326fe751e037161e1c780c9bc639c4c

    • Size

      763KB

    • MD5

      7dfb952c184cd0e1d8ad2df971a83986

    • SHA1

      a3d2cf69513c7d7ddd020eb11ad40c5ee790fd28

    • SHA256

      658e2f44c6e3a6af989069dc2fc82337c326fe751e037161e1c780c9bc639c4c

    • SHA512

      be9a46365483bdb02751fa4237e08685b3184b23d93f99b039a3f66a0496feeeb8a83ba2cf37a25fda7ca701d44f36f1fd834893be1fdd55d966d360d35ca77c

    • SSDEEP

      12288:yz+I6yWn7fcpVZlu/6uH30nEZ+ym9ENATN9O/P8xGkFp+DjwT8rHDFXVz4X6YG1y:/I698VVY30nEB09YEGkx47hlznI

    Score
    10/10
    agentteslaexecutionkeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Scheduled Task/Job

1
T1053

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks