Overview

overview

10

Static

static

3

Draft BL copy.exe

windows7-x64

10

Draft BL copy.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Draft BL copy.exe

  • Size

    688KB

  • Sample

    240522-vqqbnaab29

  • MD5

    c46f67d07641f91b79606a72b6e09270

  • SHA1

    bbbbec60fe589eb39e31a369eea5d0911167ea2b

  • SHA256

    d773db3acad368a5e51b2ea6f4cd5feb904c3255d3ef79cfcd07935a46400e38

  • SHA512

    517f8bfe7101444fa2ff9b9d6a625dde8193aa6d6bf9326288c5f35f697549527d7d9d5f6f7e2161871b223db0a7124c0323c347d41cefe99bad99d0915438b1

  • SSDEEP

    12288:jEAmDvY15gM3Co16QVl0QVXH3CG/ySQvBk0hRfr92bP0fb2RZoIeahAtY7iGUz2:jvb3F4oXCzlvBk0hh4boCXsahPiG

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      Draft BL copy.exe

    • Size

      688KB

    • MD5

      c46f67d07641f91b79606a72b6e09270

    • SHA1

      bbbbec60fe589eb39e31a369eea5d0911167ea2b

    • SHA256

      d773db3acad368a5e51b2ea6f4cd5feb904c3255d3ef79cfcd07935a46400e38

    • SHA512

      517f8bfe7101444fa2ff9b9d6a625dde8193aa6d6bf9326288c5f35f697549527d7d9d5f6f7e2161871b223db0a7124c0323c347d41cefe99bad99d0915438b1

    • SSDEEP

      12288:jEAmDvY15gM3Co16QVl0QVXH3CG/ySQvBk0hRfr92bP0fb2RZoIeahAtY7iGUz2:jvb3F4oXCzlvBk0hh4boCXsahPiG

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks