Overview

overview

10

Static

static

5

7488ca7862...0e.exe

windows7-x64

10

7488ca7862...0e.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    7488ca7862e4f048641887a7b5871c2c6951a7b0bb7c1fe2280791ee67c3170e

  • Size

    1.2MB

  • Sample

    240608-b19y9sfc31

  • MD5

    0ed3cf6d08a004d3a2919aa83f1322a6

  • SHA1

    a4d661a75085cc9ad1d5c43a0a6a231df19f6c71

  • SHA256

    7488ca7862e4f048641887a7b5871c2c6951a7b0bb7c1fe2280791ee67c3170e

  • SHA512

    888337ade4c215c301d02256f81d148f71aeed3e4b938272168f23909730fca11a9d9a3797b6d8857f7ef8cb79a40f2f9460bb9e4c11ef68d1437216e77d84a2

  • SSDEEP

    24576:7AHnh+eWsN3skA4RV1Hom2KXMmHaUFB3WbQa/R9szWv0D5:Wh+ZkldoPK8YaULza/b0Wvo

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      7488ca7862e4f048641887a7b5871c2c6951a7b0bb7c1fe2280791ee67c3170e

    • Size

      1.2MB

    • MD5

      0ed3cf6d08a004d3a2919aa83f1322a6

    • SHA1

      a4d661a75085cc9ad1d5c43a0a6a231df19f6c71

    • SHA256

      7488ca7862e4f048641887a7b5871c2c6951a7b0bb7c1fe2280791ee67c3170e

    • SHA512

      888337ade4c215c301d02256f81d148f71aeed3e4b938272168f23909730fca11a9d9a3797b6d8857f7ef8cb79a40f2f9460bb9e4c11ef68d1437216e77d84a2

    • SSDEEP

      24576:7AHnh+eWsN3skA4RV1Hom2KXMmHaUFB3WbQa/R9szWv0D5:Wh+ZkldoPK8YaULza/b0Wvo

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks