Overview

overview

10

Static

static

5

d96bb6b110...43.exe

windows7-x64

10

d96bb6b110...43.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d96bb6b110631c3a06afe836cb4f78d158c276ff0e1eea23a5cac39fec0e0e43.exe

  • Size

    1.0MB

  • Sample

    240523-q9v9ssdd7v

  • MD5

    5f0a83b1939cd3149ed5eba4ab88275b

  • SHA1

    8e465479824d6bf63860b48573bc92faa18c9281

  • SHA256

    d96bb6b110631c3a06afe836cb4f78d158c276ff0e1eea23a5cac39fec0e0e43

  • SHA512

    a739fc54a5217a823d72c14c37c0e5842d2c84f94ceeb264d023486b4d24843bf5e22a3236833e935bb04fe751ea7ec10e4fa2234edd6f7a309d3447584cdcea

  • SSDEEP

    24576:6AHnh+eWsN3skA4RV1Hom2KXMmHac4XSQi+vV3yPV5:Nh+ZkldoPK8Yac4iQiuV3o

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      d96bb6b110631c3a06afe836cb4f78d158c276ff0e1eea23a5cac39fec0e0e43.exe

    • Size

      1.0MB

    • MD5

      5f0a83b1939cd3149ed5eba4ab88275b

    • SHA1

      8e465479824d6bf63860b48573bc92faa18c9281

    • SHA256

      d96bb6b110631c3a06afe836cb4f78d158c276ff0e1eea23a5cac39fec0e0e43

    • SHA512

      a739fc54a5217a823d72c14c37c0e5842d2c84f94ceeb264d023486b4d24843bf5e22a3236833e935bb04fe751ea7ec10e4fa2234edd6f7a309d3447584cdcea

    • SSDEEP

      24576:6AHnh+eWsN3skA4RV1Hom2KXMmHac4XSQi+vV3yPV5:Nh+ZkldoPK8Yac4iQiuV3o

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks