Overview

overview

10

Static

static

5

7c365ce0e3...dc.exe

windows7-x64

10

7c365ce0e3...dc.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7c365ce0e3489852c8e6680bab779495083c48961985fa64d34696b4e2e598dc

  • Size

    1020KB

  • Sample

    240523-cw3vtsag44

  • MD5

    8fdddd6c1778965fa675530b23081555

  • SHA1

    7d436c8232a5a6044e3c15a18d662183f16cf3ab

  • SHA256

    7c365ce0e3489852c8e6680bab779495083c48961985fa64d34696b4e2e598dc

  • SHA512

    d01cb45ec86daf6fceae8d45417ad7dee1c560fc41ead0133216f95d6cdec9544e947e32b750c83afee14036d5b9f05ea0e89ac52cfa5ab61e37cb44a9582712

  • SSDEEP

    24576:QAHnh+eWsN3skA4RV1Hom2KXMmHay9tBlWDh5:Hh+ZkldoPK8Yay5lk

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      7c365ce0e3489852c8e6680bab779495083c48961985fa64d34696b4e2e598dc

    • Size

      1020KB

    • MD5

      8fdddd6c1778965fa675530b23081555

    • SHA1

      7d436c8232a5a6044e3c15a18d662183f16cf3ab

    • SHA256

      7c365ce0e3489852c8e6680bab779495083c48961985fa64d34696b4e2e598dc

    • SHA512

      d01cb45ec86daf6fceae8d45417ad7dee1c560fc41ead0133216f95d6cdec9544e947e32b750c83afee14036d5b9f05ea0e89ac52cfa5ab61e37cb44a9582712

    • SSDEEP

      24576:QAHnh+eWsN3skA4RV1Hom2KXMmHay9tBlWDh5:Hh+ZkldoPK8Yay5lk

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks