Overview

overview

10

Static

static

3

Zamów nr ...df.exe

windows7-x64

10

Zamów nr ...df.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Zamów nr 90016288247_ ZNG_1406_MG_2024_004782922.pdf.exe

  • Size

    2.0MB

  • Sample

    240523-hwjd3sha4s

  • MD5

    d81b4a2a5f96fb13ba259a1fae296ace

  • SHA1

    ba47840dfff065356f10a05464c75c6a4cb70b7a

  • SHA256

    c685ab98e1910af3a51286a6d68d706e2a7be5298f74c061f98b9e87e290d357

  • SHA512

    586908b31e61657f9f55b914f5b3a5b232ea1d1219025d2765a8d5f5bf35aa127d610d82c597bc38ddc8d69167179f068949a72ae28ab2f9732f0b2f76ba7bb8

  • SSDEEP

    24576:kynjN3fi9dEoZR814OEQjls30eTFxmT4i8eMOq52tOXuq01dKqOFCBvx1prO:VjN3CdJ81nEQhs30eruqsrOFCBbprO

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      Zamów nr 90016288247_ ZNG_1406_MG_2024_004782922.pdf.exe

    • Size

      2.0MB

    • MD5

      d81b4a2a5f96fb13ba259a1fae296ace

    • SHA1

      ba47840dfff065356f10a05464c75c6a4cb70b7a

    • SHA256

      c685ab98e1910af3a51286a6d68d706e2a7be5298f74c061f98b9e87e290d357

    • SHA512

      586908b31e61657f9f55b914f5b3a5b232ea1d1219025d2765a8d5f5bf35aa127d610d82c597bc38ddc8d69167179f068949a72ae28ab2f9732f0b2f76ba7bb8

    • SSDEEP

      24576:kynjN3fi9dEoZR814OEQjls30eTFxmT4i8eMOq52tOXuq01dKqOFCBvx1prO:VjN3CdJ81nEQhs30eruqsrOFCBbprO

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks