Overview

overview

10

Static

static

5

SHANDONG F...cr.exe

windows7-x64

10

SHANDONG F...cr.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SHANDONG FU EN - PARTICULARS.xls.scr.exe

  • Size

    1.2MB

  • Sample

    240805-p9s9rszhmf

  • MD5

    e7bbf0cdad776a34d5077e9b20a3869e

  • SHA1

    436eb845cce323fbea48e61bd9604e32f1b8f78c

  • SHA256

    519b23a4f4c11a3608f08b56f1e287358c353702b8eb48bb0357daac52a54939

  • SHA512

    592ab84e908e9437319a3dab37d5db5ed546028a90087fcbaa7e5610f206338aec167cc3a17336b8d2138e036905e5966009d9a1ce9d2123663a8516586f0a77

  • SSDEEP

    24576:cqDEvCTbMWu7rQYlBQcBiT6rprG8aRon78rGCHRCSrr:cTvC/MTQYxsWR7aRM4rGCxd

Score
10/10
agentteslacredential_accessdiscoverykeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      SHANDONG FU EN - PARTICULARS.xls.scr.exe

    • Size

      1.2MB

    • MD5

      e7bbf0cdad776a34d5077e9b20a3869e

    • SHA1

      436eb845cce323fbea48e61bd9604e32f1b8f78c

    • SHA256

      519b23a4f4c11a3608f08b56f1e287358c353702b8eb48bb0357daac52a54939

    • SHA512

      592ab84e908e9437319a3dab37d5db5ed546028a90087fcbaa7e5610f206338aec167cc3a17336b8d2138e036905e5966009d9a1ce9d2123663a8516586f0a77

    • SSDEEP

      24576:cqDEvCTbMWu7rQYlBQcBiT6rprG8aRon78rGCHRCSrr:cTvC/MTQYxsWR7aRM4rGCxd

    Score
    10/10
    agentteslacredential_accessdiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks