Overview

overview

10

Static

static

5

0b0cd503d2...0N.exe

windows7-x64

10

0b0cd503d2...0N.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0b0cd503d287cbc0d4ecf74c87b64730N.exe

  • Size

    1.2MB

  • Sample

    240727-14mqksvapf

  • MD5

    0b0cd503d287cbc0d4ecf74c87b64730

  • SHA1

    9df4410468579f2f454751e10cd4a117b71c7336

  • SHA256

    673f5ec608cafec3fd67b2ee20cc966560c0a4d255788741ad8c6c2711df7f73

  • SHA512

    1f1b4db38a321a76a5bb3fb68486a48c7ab17bd0cfe90b461addf73a26a7c2ca1ccc21d452cd966b8eb38bf35391f04aaf0bcad4f2e87fda46b90e08572b8958

  • SSDEEP

    24576:zqDEvCTbMWu7rQYlBQcBiT6rprG8afEBkoNOq507:zTvC/MTQYxsWR7afEBQM0

Score
10/10
agentteslacredential_accessdiscoverykeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      0b0cd503d287cbc0d4ecf74c87b64730N.exe

    • Size

      1.2MB

    • MD5

      0b0cd503d287cbc0d4ecf74c87b64730

    • SHA1

      9df4410468579f2f454751e10cd4a117b71c7336

    • SHA256

      673f5ec608cafec3fd67b2ee20cc966560c0a4d255788741ad8c6c2711df7f73

    • SHA512

      1f1b4db38a321a76a5bb3fb68486a48c7ab17bd0cfe90b461addf73a26a7c2ca1ccc21d452cd966b8eb38bf35391f04aaf0bcad4f2e87fda46b90e08572b8958

    • SSDEEP

      24576:zqDEvCTbMWu7rQYlBQcBiT6rprG8afEBkoNOq507:zTvC/MTQYxsWR7afEBQM0

    Score
    10/10
    agentteslacredential_accessdiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Discovery

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks