Overview

overview

10

Static

static

1

packinglis...nt.exe

windows7-x64

10

packinglis...nt.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    packinglist and shippment.7z
  • Size 713KB
  • Sample240608-rxelysdd59
  • SHA256 5be914c978e8a858a23d07b9c78e506741349369484762bc424b87a8934ff7df
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
agentteslaexecutionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

  • agenttesla

Credentials

Targets

    • Target
      packinglist and shippment.exe
    • Size 977KB
    • SHA256 dd566ea9737c75cf44885c842a944952d23abc1fb315867b4f07c3b8f37ce01b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    agentteslaexecutionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks