Overview

overview

10

Static

static

3

Kopx Perm starter.exe

windows7-x64

1

Kopx Perm starter.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Kopx Perm starter.exe

  • Size

    690KB

  • Sample

    240907-d7a5mashlq

  • MD5

    254734b009bab35cda2c3b853868ead4

  • SHA1

    d355217e7b2f4d6950b590e2cb56570e0d7e5a57

  • SHA256

    62d224143ab1462293c94cc449f2174d1bf8a3635f22614ba391bc3a4f331e74

  • SHA512

    cfec6c6177cd9b43d5f92b3c152dd9851339dcbe63a123a7f72606a222041c4134491b29830d58b09217ff9c7e6374fb1e83acaf3d4158c8dcb9340467a912c5

  • SSDEEP

    6144:lBKjK2LFzZNf/ULF7XqPhjYXFuc/xBOUzjIGcmKqc4cq2cctc/wccyQcycnt4c6u:lMjnNf30FnhV7C0FnhVjp

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      Kopx Perm starter.exe

    • Size

      690KB

    • MD5

      254734b009bab35cda2c3b853868ead4

    • SHA1

      d355217e7b2f4d6950b590e2cb56570e0d7e5a57

    • SHA256

      62d224143ab1462293c94cc449f2174d1bf8a3635f22614ba391bc3a4f331e74

    • SHA512

      cfec6c6177cd9b43d5f92b3c152dd9851339dcbe63a123a7f72606a222041c4134491b29830d58b09217ff9c7e6374fb1e83acaf3d4158c8dcb9340467a912c5

    • SSDEEP

      6144:lBKjK2LFzZNf/ULF7XqPhjYXFuc/xBOUzjIGcmKqc4cq2cctc/wccyQcycnt4c6u:lMjnNf30FnhV7C0FnhVjp

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla payload

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks