Overview

overview

10

Static

static

5

dccd011bce...8c.exe

windows7-x64

10

dccd011bce...8c.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    349b75eb0d5c74b180c668dcaafcf5e6b8755d1278eb625e3769f6461924bc30

  • Size

    840KB

  • Sample

    240817-cnxnvavdkl

  • MD5

    0dad893d48ccaf778d2f809295ccd84a

  • SHA1

    0d2f333a48ea23d4849cb97dcfa0b602116e3a05

  • SHA256

    349b75eb0d5c74b180c668dcaafcf5e6b8755d1278eb625e3769f6461924bc30

  • SHA512

    1c0e0bc85c401d0a8d8c411317bad409643330a8adea1b48c4636225049426112478bfd4c52218a184bc2c260ff264a7e558c1cbe8da985a4ea6e5df50ce3858

  • SSDEEP

    12288:aCYSINfkAAq0dkCAlyydmzdaaotYd8Ox3r4EWG3Am8RvkrwwF6UdsoqIKHJpIK:mSIiABuzdgtcx3VAZZmFnGoqdJpIK

Score
10/10
agentteslacredential_accessdiscoverykeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      dccd011bce927cea2b3f0d2ff0198a100df5d3f522f12e4d2fbff9d8e568528c.exe

    • Size

      1.3MB

    • MD5

      9d9add306867d29b9b665c6c7b65b053

    • SHA1

      07030039678cd165662d4019b18b8f4c1a012c5f

    • SHA256

      dccd011bce927cea2b3f0d2ff0198a100df5d3f522f12e4d2fbff9d8e568528c

    • SHA512

      a05dc2209a8de1771e7275c96152009972aa1fba34247639befe537a8af75ab7e64234ab343112062f32e5b971a40ea71602bb75ccf2376b69dfb7bb6112e7b4

    • SSDEEP

      24576:6qDEvCTbMWu7rQYlBQcBiT6rprG8aE545pGu0nbkTEamFblGg+y6tuI6l:6TvC/MTQYxsWR7aE545pGu0nbkT4lkgq

    Score
    10/10
    agentteslacredential_accessdiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks