Overview

overview

10

Static

static

1

3e79fc95ac...8a.rtf

windows7-x64

10

3e79fc95ac...8a.rtf

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3e79fc95acbfbe53ef642e5b88edb806c45c6624634ec9b8a355d16dc72c078a

  • Size

    46KB

  • Sample

    240529-bp1lfscd8v

  • MD5

    e1f38ac4318814b4f2006f9311702fbb

  • SHA1

    9d4fce1aeaba9167eb9d6dc7de05dfbad1e47ef8

  • SHA256

    3e79fc95acbfbe53ef642e5b88edb806c45c6624634ec9b8a355d16dc72c078a

  • SHA512

    4d5f16200181e69b14500ff86937b23d9d7493429580605e55a5f697f1e3c45ab66a92aaf1f66e834601a7777e16b22432fe7a862aa56327c97558c1c93315d7

  • SSDEEP

    768:hhYP/k5jiYp5ebg2BRhkzzZXBGuVyyARX0cI6lJMyfOkr6ff8tMz4Fxj:hhys5jhebg2BRhYzZXyR/I6lJMyxr6f4

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      3e79fc95acbfbe53ef642e5b88edb806c45c6624634ec9b8a355d16dc72c078a

    • Size

      46KB

    • MD5

      e1f38ac4318814b4f2006f9311702fbb

    • SHA1

      9d4fce1aeaba9167eb9d6dc7de05dfbad1e47ef8

    • SHA256

      3e79fc95acbfbe53ef642e5b88edb806c45c6624634ec9b8a355d16dc72c078a

    • SHA512

      4d5f16200181e69b14500ff86937b23d9d7493429580605e55a5f697f1e3c45ab66a92aaf1f66e834601a7777e16b22432fe7a862aa56327c97558c1c93315d7

    • SSDEEP

      768:hhYP/k5jiYp5ebg2BRhkzzZXBGuVyyARX0cI6lJMyfOkr6ff8tMz4Fxj:hhys5jhebg2BRhYzZXyR/I6lJMyxr6f4

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks