Overview

overview

10

Static

static

3

d5f29a5064...1d.exe

windows7-x64

10

d5f29a5064...1d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d5f29a50645c9638fc922d28d80d71dbdd2beae8a12fa992ac4ac36707f1cb1d

  • Size

    736KB

  • Sample

    240523-cr4assae65

  • MD5

    36ddd1dffdf875e7508e7a97ae2fca28

  • SHA1

    bb226ed21720c6d636bde06559721e5411dc00c1

  • SHA256

    d5f29a50645c9638fc922d28d80d71dbdd2beae8a12fa992ac4ac36707f1cb1d

  • SHA512

    416831748aceb8a7393a9f745b60aafdf5d0db3a174b5473bc99ec2c790c0d450f2108e0a11107f0e7e98987442c0fbdabd61342943d40d95aed942662fa45fb

  • SSDEEP

    12288:M5+li8LkpEaGky9cDiUq+M74DhRLHmCC6sCgsL3eMzytkqd78IO3U/69Hs60t1SY:YjEa1G4DhRLHmgRzqNRO3USh6t

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      d5f29a50645c9638fc922d28d80d71dbdd2beae8a12fa992ac4ac36707f1cb1d

    • Size

      736KB

    • MD5

      36ddd1dffdf875e7508e7a97ae2fca28

    • SHA1

      bb226ed21720c6d636bde06559721e5411dc00c1

    • SHA256

      d5f29a50645c9638fc922d28d80d71dbdd2beae8a12fa992ac4ac36707f1cb1d

    • SHA512

      416831748aceb8a7393a9f745b60aafdf5d0db3a174b5473bc99ec2c790c0d450f2108e0a11107f0e7e98987442c0fbdabd61342943d40d95aed942662fa45fb

    • SSDEEP

      12288:M5+li8LkpEaGky9cDiUq+M74DhRLHmCC6sCgsL3eMzytkqd78IO3U/69Hs60t1SY:YjEa1G4DhRLHmgRzqNRO3USh6t

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks