Overview

overview

10

Static

static

3

leylaty-RA...df.exe

windows7-x64

10

leylaty-RA...df.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d2eb19707d30018ecf87f0d198d72fbd_JaffaCakes118

  • Size

    663KB

  • Sample

    240907-1tx4kazdqa

  • MD5

    d2eb19707d30018ecf87f0d198d72fbd

  • SHA1

    df4cf459adb8072b4d413351b94ed2afba800f92

  • SHA256

    bc311f2845a756c0ff57e94abac7f894e60338ddc08187324154005d45c32456

  • SHA512

    02df175005cbef12e364769f219942e36d1447f9206713b73501bfd3b435df0c673f5263fe85c7b6c6506c81af31556d1e072e0ac5523efa620777a43213967e

  • SSDEEP

    12288:AlwUFxnPNsjoFhnFs7oXwkpvdv9DmfhTkqzG6tYt3NYgUGpWbAHxrGysz5jSgXYC:At/NmoF3s7YwA854qp6t9LUW1Hpg5jtR

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.sizetekstil.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    wsxa58ax

Targets

    • Target

      leylaty-RAK-16.02.2021,pdf.exe

    • Size

      922KB

    • MD5

      98e4d53f6ddd58d28af89b921bf5d6ea

    • SHA1

      83486dab455ecedbe530ff267958cc07e2ed6f5d

    • SHA256

      a710f59d3a9366dcac9bf7ead6fc0382b72373fe55e97bc32e3149960ed41bea

    • SHA512

      39774eff85e9485fa39ad12fd0e832b64f746c3da7c448c1a270977e8c5ee11ae205cc5e787d4216bf448b511f9e03b0b5b9257df73bbfd5356dca1bcc2bb997

    • SSDEEP

      24576:8fJ6Y86Z7iYtU+wkxQqBwtfLoA8A5jBmj:aJZ7iYtvBwtj18AZBmj

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks