Overview

overview

10

Static

static

3

QUOTATION_...DF.scr

windows7-x64

10

QUOTATION_...DF.scr

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    MV SONYA BLADE.z

  • Size

    61KB

  • Sample

    240610-nlynxahf49

  • MD5

    4c43ef4d69f357256cc9d2e1c4a49440

  • SHA1

    f888b283c7930fa6d54a43e5c861d71af5876b3c

  • SHA256

    012b08102596057a6c4e0ce95bf909e0115210815f053e83bd919260d90005d4

  • SHA512

    4f25b51dedb09444cab6a5d07561fe45ce2ee2e9701366d7790555181e4fc4d4741ac06467c66bdfbbddfe0262502ee13cb8507ff926e4e1adb74828c6458461

  • SSDEEP

    1536:uzEf0nhyLF7UJaKrxfDt5UJ6x4SuV/gYFVFLqByrHq+e+I:FLKaK97fzCX6YHFmQeb

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      QUOTATION_JUNQTRA031244PDF.scr

    • Size

      400KB

    • MD5

      95bf7ae943e99659981d78524c22adc3

    • SHA1

      b2a365d8f22d01f2ec582b44dc2b65991021f847

    • SHA256

      d27fc56cf04b3afdf22aa89fde43033057b5136dbf26ead08cef6e1594ba6ba0

    • SHA512

      4d1dce48114e7ac8e11a390d4fc64a64205668c50231124cbcc70169356cdd822b7520dbeb0e1147f8e8c727e274830e153b0e21a34a1872a7e9c1a4c1d4214c

    • SSDEEP

      1536:siC2JBSv6cWiO5NFN9KyQZ3Dq6wUaYQ7qPpqOLy0uyL+fX:siCl6T7HQZ3D9davYuyu

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks