Overview

overview

10

Static

static

5

be4e2c43c1...a4.exe

windows7-x64

10

be4e2c43c1...a4.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    be4e2c43c17385a201b36e359caf16d4e08e1a63a1c1ced26422f9aa593e07a4

  • Size

    1.1MB

  • Sample

    240704-blws4axhpe

  • MD5

    49ee0247d3e09e9889a1bae8f66793a6

  • SHA1

    12512f5707794a2740485a0e7c179c41f34c9d2e

  • SHA256

    be4e2c43c17385a201b36e359caf16d4e08e1a63a1c1ced26422f9aa593e07a4

  • SHA512

    1ec9648542d69ce525f7afde99347e574e2db6a45f65eb85b25cb7dfacef85c5384ca86e1231cedfa7e6c8ac65093e5c4b7901a90802c82ef6dce49036721484

  • SSDEEP

    24576:9AHnh+eWsN3skA4RV1Hom2KXMmHaSm/Iv2lZ42KyIKPDj5:ch+ZkldoPK8YaS0Iv4ehyhPR

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      be4e2c43c17385a201b36e359caf16d4e08e1a63a1c1ced26422f9aa593e07a4

    • Size

      1.1MB

    • MD5

      49ee0247d3e09e9889a1bae8f66793a6

    • SHA1

      12512f5707794a2740485a0e7c179c41f34c9d2e

    • SHA256

      be4e2c43c17385a201b36e359caf16d4e08e1a63a1c1ced26422f9aa593e07a4

    • SHA512

      1ec9648542d69ce525f7afde99347e574e2db6a45f65eb85b25cb7dfacef85c5384ca86e1231cedfa7e6c8ac65093e5c4b7901a90802c82ef6dce49036721484

    • SSDEEP

      24576:9AHnh+eWsN3skA4RV1Hom2KXMmHaSm/Iv2lZ42KyIKPDj5:ch+ZkldoPK8YaS0Iv4ehyhPR

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks