Overview

overview

10

Static

static

5

18841f0413...69.exe

windows7-x64

10

18841f0413...69.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    18841f0413611beaead1e4fecb01c776e8ec11f7416f6219ada978d606e33869

  • Size

    1.1MB

  • Sample

    240608-bkrsraeh5x

  • MD5

    99c6d79cd972cef9e87247ba4f03e7fe

  • SHA1

    9da74f9ae6d6f0a05079252bab866d66a024e080

  • SHA256

    18841f0413611beaead1e4fecb01c776e8ec11f7416f6219ada978d606e33869

  • SHA512

    04a2689e3573d5cc06de392f66e4d7cc4936725ee5722d6bea91d63ad8f34854dda43d55495c0075ffbac80b1a3ae7082b7c547f55f55c648a6008f0b41bf30e

  • SSDEEP

    24576:mAHnh+eWsN3skA4RV1Hom2KXMmHaXIjvRwTGv4aYn5:Bh+ZkldoPK8YaX4kGv4n

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      18841f0413611beaead1e4fecb01c776e8ec11f7416f6219ada978d606e33869

    • Size

      1.1MB

    • MD5

      99c6d79cd972cef9e87247ba4f03e7fe

    • SHA1

      9da74f9ae6d6f0a05079252bab866d66a024e080

    • SHA256

      18841f0413611beaead1e4fecb01c776e8ec11f7416f6219ada978d606e33869

    • SHA512

      04a2689e3573d5cc06de392f66e4d7cc4936725ee5722d6bea91d63ad8f34854dda43d55495c0075ffbac80b1a3ae7082b7c547f55f55c648a6008f0b41bf30e

    • SSDEEP

      24576:mAHnh+eWsN3skA4RV1Hom2KXMmHaXIjvRwTGv4aYn5:Bh+ZkldoPK8YaX4kGv4n

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks