Overview

overview

10

Static

static

5

Payment_Adv.exe

windows7-x64

10

Payment_Adv.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ffd4c1cd38f8d05ffc5ba76ff28e1992e26cc3001e79cbf03c77b46abf6df260

  • Size

    735KB

  • Sample

    240712-bzassawajf

  • MD5

    8a95f62b229f30919c71b16a97e057b6

  • SHA1

    f5213368e095c37501c91711be91e6a37ea2f8b3

  • SHA256

    ffd4c1cd38f8d05ffc5ba76ff28e1992e26cc3001e79cbf03c77b46abf6df260

  • SHA512

    c46144b89a2fc6a8bb49fd3a2c92c292eb03718002117b8d8a681534c937a1bd6a782f27f4d14fa5c3afcd932f6777d57d1490c28099a1d6858194ec66b460b3

  • SSDEEP

    12288:2pN9zV5DPwx/UAUXU+7qf6S1R04JbnnV5yq/G7oHLTf9nGr8mbhD8ijbaZGQ3Ppz:2lHDPwWAoSn04DnbGeLBu8rzPpXoS

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      Payment_Adv.exe

    • Size

      1.1MB

    • MD5

      351f1b364d598d3d1074d4a8a6df9923

    • SHA1

      4cb6d6a2f5ba364768c73ffabbcd78617f05775f

    • SHA256

      c6f67fcb5429fe7f5b04e00b331a8120998e6b22dbe8d4eacfa7a32b0c970025

    • SHA512

      b7382f298e3dd2416806376111656161494ba27edbb0ed4c4256feb5ea9d24ee4a70c66aff30bb629b07474d9ab77059ed9989a1f989d3eb042a555dc358b938

    • SSDEEP

      24576:SAHnh+eWsN3skA4RV1Hom2KXMmHaJTO8LBu8bBPndy3VLb5:Vh+ZkldoPK8YaJRduqB/o3Vx

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks