Overview

overview

10

Static

static

5

NEW PO (PO...7).exe

windows7-x64

10

NEW PO (PO...7).exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    205dd20d543eb75700c7ae6da003850c1761420dc70e44c159459c23e9a97e82

  • Size

    627KB

  • Sample

    240711-wp8x2sxhqj

  • MD5

    ce8b1146ced9336cf8ef6d76a504f172

  • SHA1

    acdb404bc983068f9b75518bc08b9e3453c91162

  • SHA256

    205dd20d543eb75700c7ae6da003850c1761420dc70e44c159459c23e9a97e82

  • SHA512

    423b054d823cc8930f2ea7b304da5ee6409b0c4c3f1270c9e3eab08d257fa89ae46e8976f37a38b0daf915327161f51e0e2b67e50d925379237458d9c41a9996

  • SSDEEP

    12288:fFabde08084X/SK7t9isQxuZB80ohfpLPBX6uYvXWrkUExZ0vuS:f6du08mHqHxuZRorP5jEbUE0vN

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      NEW PO (PO01-240227).exe

    • Size

      1.1MB

    • MD5

      15a3c0ffce7a10d319380822a996380c

    • SHA1

      1d9f99a0113a707af832375345dd28c3dedd379b

    • SHA256

      0db79a9b13b022f64973aa882fb3dcd4aba130588271ef11c32c9831f2b38d61

    • SHA512

      f325d0ea20fe61b339fe0bf68d5ee248a19a64d425a4d1553e3960b871a54dda7431cf4d279b2aa316f0cc01eee21492f007dddaf5417e95e93aeb67d61b0b26

    • SSDEEP

      24576:xAHnh+eWsN3skA4RV1Hom2KXMmHaGtE6mfjKhnQ2w64rV/J5:Ih+ZkldoPK8YaGylf2Zdw6wVL

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks