Overview

overview

10

Static

static

5

loading advice..exe

windows7-x64

10

loading advice..exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    loading advice..exe

  • Size

    1.2MB

  • Sample

    240624-twgq2a1gjg

  • MD5

    399130684aee0b0adedc983f06bb587e

  • SHA1

    e17bacd7de440fc3d560166227354185b6cbdeb9

  • SHA256

    cda61139578f1cb169cfaa8b588dd7691c4f912baab91ad355ced6ea3edfdabe

  • SHA512

    d9899d5b592be191ae64f0f06e2c69045790ba81c2364a7640f802ad48c25f10910a981ec9da878a4c11ec493be80c1eaf27d747651ac4ab6bd3356d3a386895

  • SSDEEP

    24576:OAHnh+eWsN3skA4RV1Hom2KXMmHa0P6nnjqKoepUW8NHRdrt3t5:5h+ZkldoPK8YaHjqKoepUJNHRdxX

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      loading advice..exe

    • Size

      1.2MB

    • MD5

      399130684aee0b0adedc983f06bb587e

    • SHA1

      e17bacd7de440fc3d560166227354185b6cbdeb9

    • SHA256

      cda61139578f1cb169cfaa8b588dd7691c4f912baab91ad355ced6ea3edfdabe

    • SHA512

      d9899d5b592be191ae64f0f06e2c69045790ba81c2364a7640f802ad48c25f10910a981ec9da878a4c11ec493be80c1eaf27d747651ac4ab6bd3356d3a386895

    • SSDEEP

      24576:OAHnh+eWsN3skA4RV1Hom2KXMmHa0P6nnjqKoepUW8NHRdrt3t5:5h+ZkldoPK8YaHjqKoepUJNHRdxX

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks