Overview

overview

10

Static

static

5

27840a87db...76.exe

windows7-x64

10

27840a87db...76.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    27840a87db8fe5f9d73b741f7c9d6e0d40d44d3733da053d2d26019398d17d76

  • Size

    1.2MB

  • Sample

    240727-bjhtfsxank

  • MD5

    3e940e51c2f61cd8482764ab788fc29c

  • SHA1

    0190e8e9ea92aaab23cca316d1e55eef31bb4f2d

  • SHA256

    27840a87db8fe5f9d73b741f7c9d6e0d40d44d3733da053d2d26019398d17d76

  • SHA512

    8f0b59f1d46d8232cb150a9d7500022e37cac435291d0b4e93ccc7a937dc32d507f193768d55922fedb68402901f6def02f56772a05910d3bc01853c3c069574

  • SSDEEP

    24576:8qDEvCTbMWu7rQYlBQcBiT6rprG8aALarseL2ZFj8Zen86:8TvC/MTQYxsWR7aALZR8Zg8

Score
10/10
agentteslacredential_accessdiscoverykeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      27840a87db8fe5f9d73b741f7c9d6e0d40d44d3733da053d2d26019398d17d76

    • Size

      1.2MB

    • MD5

      3e940e51c2f61cd8482764ab788fc29c

    • SHA1

      0190e8e9ea92aaab23cca316d1e55eef31bb4f2d

    • SHA256

      27840a87db8fe5f9d73b741f7c9d6e0d40d44d3733da053d2d26019398d17d76

    • SHA512

      8f0b59f1d46d8232cb150a9d7500022e37cac435291d0b4e93ccc7a937dc32d507f193768d55922fedb68402901f6def02f56772a05910d3bc01853c3c069574

    • SSDEEP

      24576:8qDEvCTbMWu7rQYlBQcBiT6rprG8aALarseL2ZFj8Zen86:8TvC/MTQYxsWR7aALZR8Zg8

    Score
    10/10
    agentteslacredential_accessdiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Discovery

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks