Overview

overview

10

Static

static

5

856e2d6a31...ee.exe

windows7-x64

10

856e2d6a31...ee.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    43b8f572e102bbe761313fecda043c25179d66554315ff486e1e0e2921810bf6

  • Size

    600KB

  • Sample

    240531-gezjashh44

  • MD5

    250ec22a29f11f9896097fcd8489e691

  • SHA1

    02c5c040379b452995858a9a186b1a9b44a61534

  • SHA256

    43b8f572e102bbe761313fecda043c25179d66554315ff486e1e0e2921810bf6

  • SHA512

    c5831e913975957386527c0bd9b00c592cd6f881e8c439a79873dd13ebab392a1c6a7ced98c684b5bbbecd680cff9e2bc6631c996a7d893deab97cb33d0d8160

  • SSDEEP

    12288:J2t/lxuJC60+fcA8D4LwzEEyvywoitwxZZWJuEC0+h2soby9Odaxnt9P4Z:JsnuJC60+kmLwYEzgCz+uH0Ztbran5Y

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      856e2d6a314105b7d6720bad42e6fa4c1be002e8ca6059e1d0c76be9995628ee.exe

    • Size

      1021KB

    • MD5

      da9153af49296bcb0199e7cd13219611

    • SHA1

      c7fce888526c0b1b646dd957e197c72a41f98acc

    • SHA256

      856e2d6a314105b7d6720bad42e6fa4c1be002e8ca6059e1d0c76be9995628ee

    • SHA512

      a04938e1482200e5844ec3ccbcaa5d47dd3a94e484da24f814248ff07b6461b8812ab91cddabd35c6e1ca766d7c5ccc7d22924b9bc4bc4ebb0bb519c60e3ecc9

    • SSDEEP

      24576:6AHnh+eWsN3skA4RV1Hom2KXMmHafTv3ywltJ2DzT5:Nh+ZkldoPK8YafTv5eDJ

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks