Overview

overview

10

Static

static

5

3d983115cb...06.exe

windows7-x64

10

3d983115cb...06.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    3d983115cbb929fdcdcb923b05feec1c6844a9ee7702e3c1f6686c8a6d140806

  • Size

    1004KB

  • Sample

    240525-g8x8bshd32

  • MD5

    075d24eaa7b4efd472681fee7311f029

  • SHA1

    637620bde6421b9fffbd56d0314b030241bd0d81

  • SHA256

    3d983115cbb929fdcdcb923b05feec1c6844a9ee7702e3c1f6686c8a6d140806

  • SHA512

    700c8a45373cdee64b91e99ed8ab85ecbf107b8e858d3bb82919990b349868dda96eeafe8d973c6506611cba268c07e2a21e846464e2b6b7adb1790b63d13cb2

  • SSDEEP

    24576:/AHnh+eWsN3skA4RV1Hom2KXMmHaV/c9kYr/5:ih+ZkldoPK8YaV/JYd

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      3d983115cbb929fdcdcb923b05feec1c6844a9ee7702e3c1f6686c8a6d140806

    • Size

      1004KB

    • MD5

      075d24eaa7b4efd472681fee7311f029

    • SHA1

      637620bde6421b9fffbd56d0314b030241bd0d81

    • SHA256

      3d983115cbb929fdcdcb923b05feec1c6844a9ee7702e3c1f6686c8a6d140806

    • SHA512

      700c8a45373cdee64b91e99ed8ab85ecbf107b8e858d3bb82919990b349868dda96eeafe8d973c6506611cba268c07e2a21e846464e2b6b7adb1790b63d13cb2

    • SSDEEP

      24576:/AHnh+eWsN3skA4RV1Hom2KXMmHaV/c9kYr/5:ih+ZkldoPK8YaV/JYd

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks