Overview

overview

10

Static

static

3

496463c749...86.exe

windows7-x64

10

496463c749...86.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    496463c7496cccbf2a3b677272ae9e0cd211bccb1363ffececa9e6b976a2b686

  • Size

    1.0MB

  • Sample

    240523-bj98psga21

  • MD5

    9167fdba7412a6714d5362a3281eddd5

  • SHA1

    faeda2c77c905b14a31749117f82770717a7dced

  • SHA256

    496463c7496cccbf2a3b677272ae9e0cd211bccb1363ffececa9e6b976a2b686

  • SHA512

    c66020878fa37fd130b3cff8726c91380448f071369c0668a78a143bda3b84eb204e27b956fc5c81ff34d9e62fb0ec2c0d91354605510eeb31efbdf6a954bfc6

  • SSDEEP

    12288:ZEK1L8WtogCbvAaUFU28u/gz0R2Jpy0fTS7DXE4jmD/V8vfa77tP+h2s6ZPcAZc9:ZIJYU2V/6pyCOD3jmllPcXV

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      496463c7496cccbf2a3b677272ae9e0cd211bccb1363ffececa9e6b976a2b686

    • Size

      1.0MB

    • MD5

      9167fdba7412a6714d5362a3281eddd5

    • SHA1

      faeda2c77c905b14a31749117f82770717a7dced

    • SHA256

      496463c7496cccbf2a3b677272ae9e0cd211bccb1363ffececa9e6b976a2b686

    • SHA512

      c66020878fa37fd130b3cff8726c91380448f071369c0668a78a143bda3b84eb204e27b956fc5c81ff34d9e62fb0ec2c0d91354605510eeb31efbdf6a954bfc6

    • SSDEEP

      12288:ZEK1L8WtogCbvAaUFU28u/gz0R2Jpy0fTS7DXE4jmD/V8vfa77tP+h2s6ZPcAZc9:ZIJYU2V/6pyCOD3jmllPcXV

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks