Overview

overview

10

Static

static

3

087f3c379a...fd.exe

windows7-x64

10

087f3c379a...fd.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    087f3c379a1f08fc51ba599872013c25ee442d1bfeb87ce93503239ea2a388fd.exe

  • Size

    1.4MB

  • Sample

    240522-r85brafa49

  • MD5

    30664b17b297bc3db34968f239360c6f

  • SHA1

    a4185b8ff9e045033d06701e200be57920753754

  • SHA256

    087f3c379a1f08fc51ba599872013c25ee442d1bfeb87ce93503239ea2a388fd

  • SHA512

    e178dd795f63ddf55ea4abbb9e9b44d493138a1be5b3b3c2928edfd59b8675e0192f223f986230854e1c8855d06041363f6f389d7d20390686e73be16acba0e1

  • SSDEEP

    24576:lsO7OVJ0W//bLLK6tsPdEZ+gqBnf5B1M8We20/ccvLpxBVtra:zixL7Z+gK28/lng

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      087f3c379a1f08fc51ba599872013c25ee442d1bfeb87ce93503239ea2a388fd.exe

    • Size

      1.4MB

    • MD5

      30664b17b297bc3db34968f239360c6f

    • SHA1

      a4185b8ff9e045033d06701e200be57920753754

    • SHA256

      087f3c379a1f08fc51ba599872013c25ee442d1bfeb87ce93503239ea2a388fd

    • SHA512

      e178dd795f63ddf55ea4abbb9e9b44d493138a1be5b3b3c2928edfd59b8675e0192f223f986230854e1c8855d06041363f6f389d7d20390686e73be16acba0e1

    • SSDEEP

      24576:lsO7OVJ0W//bLLK6tsPdEZ+gqBnf5B1M8We20/ccvLpxBVtra:zixL7Z+gK28/lng

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks