Overview

overview

10

Static

static

5

4d649a9c22...4f.exe

windows7-x64

10

4d649a9c22...4f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4d649a9c22c200ae71dc6b4fb2f7840dfa2ed78e607f4ce78f5c1ad73073f34f.exe

  • Size

    1.3MB

  • Sample

    240727-brcmea1aka

  • MD5

    3d265723ffa9ee20e76cd4eb2b628771

  • SHA1

    206bc32e4bf59574ca23b85f8d88ebdafff07307

  • SHA256

    4d649a9c22c200ae71dc6b4fb2f7840dfa2ed78e607f4ce78f5c1ad73073f34f

  • SHA512

    c71adf07df2eb29db2a3a172f7f2b6708d1727e2682b8605fe7a0ae64588e72e8a5f67321e2d45d8cd60fac95cd0b1177ca4121fdc91d77aad126c4d2a3d3612

  • SSDEEP

    24576:rqDEvCTbMWu7rQYlBQcBiT6rprG8a4AppoT+kc78Imj+PJ:rTvC/MTQYxsWR7a4AfkfIS+P

Score
10/10
agentteslacredential_accessdiscoverykeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      4d649a9c22c200ae71dc6b4fb2f7840dfa2ed78e607f4ce78f5c1ad73073f34f.exe

    • Size

      1.3MB

    • MD5

      3d265723ffa9ee20e76cd4eb2b628771

    • SHA1

      206bc32e4bf59574ca23b85f8d88ebdafff07307

    • SHA256

      4d649a9c22c200ae71dc6b4fb2f7840dfa2ed78e607f4ce78f5c1ad73073f34f

    • SHA512

      c71adf07df2eb29db2a3a172f7f2b6708d1727e2682b8605fe7a0ae64588e72e8a5f67321e2d45d8cd60fac95cd0b1177ca4121fdc91d77aad126c4d2a3d3612

    • SSDEEP

      24576:rqDEvCTbMWu7rQYlBQcBiT6rprG8a4AppoT+kc78Imj+PJ:rTvC/MTQYxsWR7a4AfkfIS+P

    Score
    10/10
    agentteslacredential_accessdiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Discovery

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks