Overview

overview

10

Static

static

5

c7dc84187e...15.exe

windows7-x64

10

c7dc84187e...15.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c7dc84187ebfc4521a3fe173e5b59850c753251a1a935b294c0a6fb63d6c9315.exe

  • Size

    1.2MB

  • Sample

    240727-cc1lcssfkg

  • MD5

    2ad0a14a883597c8707276c3002d85da

  • SHA1

    5840f94ca6dc35f3e48f7e0586e3a9724fb566d0

  • SHA256

    c7dc84187ebfc4521a3fe173e5b59850c753251a1a935b294c0a6fb63d6c9315

  • SHA512

    2c05d6c33359ae405479a6ca9b8019fc885f8c1f16e4a658f809b586336e20fc5c9dc1ac6f2ab4fbd2703a3be2716c510f26335e2a806e933dc2ef265761c288

  • SSDEEP

    24576:NqDEvCTbMWu7rQYlBQcBiT6rprG8ajYRRFPpDsb/5bxD17Ofd:NTvC/MTQYxsWR7ajYRRJpDsTVxD17Of

Score
10/10
agentteslacredential_accessdiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      c7dc84187ebfc4521a3fe173e5b59850c753251a1a935b294c0a6fb63d6c9315.exe

    • Size

      1.2MB

    • MD5

      2ad0a14a883597c8707276c3002d85da

    • SHA1

      5840f94ca6dc35f3e48f7e0586e3a9724fb566d0

    • SHA256

      c7dc84187ebfc4521a3fe173e5b59850c753251a1a935b294c0a6fb63d6c9315

    • SHA512

      2c05d6c33359ae405479a6ca9b8019fc885f8c1f16e4a658f809b586336e20fc5c9dc1ac6f2ab4fbd2703a3be2716c510f26335e2a806e933dc2ef265761c288

    • SSDEEP

      24576:NqDEvCTbMWu7rQYlBQcBiT6rprG8ajYRRFPpDsb/5bxD17Ofd:NTvC/MTQYxsWR7ajYRRJpDsTVxD17Of

    Score
    10/10
    agentteslacredential_accessdiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Discovery

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks