Overview

overview

10

Static

static

5

4122f1d85f...97.exe

windows7-x64

10

4122f1d85f...97.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4122f1d85ffb12401925c52470a6a3f4cc75e02546069894ed33ce7a6dd81897.exe

  • Size

    1.2MB

  • Sample

    240911-sfpahaxarj

  • MD5

    ddbaaa52ea1192377573a76e4ac8fb7b

  • SHA1

    0c86f1126bde5a0ab4d5dc8eb2e7aeb8b824d474

  • SHA256

    4122f1d85ffb12401925c52470a6a3f4cc75e02546069894ed33ce7a6dd81897

  • SHA512

    9c01f8e5aed73ee59c710d19c711cc360eed010b3176973369c7f329ab6964946078df8c38159adef428680f42836edc773bfb8455cad25be404082ad51c4c0b

  • SSDEEP

    24576:6AHnh+eWsN3skA4RV1Hom2KXMmHa1LodOtZQo4CPAuK85:Nh+ZkldoPK8Ya1sdOtZzPL

Score
10/10
agentteslacredential_accessdiscoverykeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      4122f1d85ffb12401925c52470a6a3f4cc75e02546069894ed33ce7a6dd81897.exe

    • Size

      1.2MB

    • MD5

      ddbaaa52ea1192377573a76e4ac8fb7b

    • SHA1

      0c86f1126bde5a0ab4d5dc8eb2e7aeb8b824d474

    • SHA256

      4122f1d85ffb12401925c52470a6a3f4cc75e02546069894ed33ce7a6dd81897

    • SHA512

      9c01f8e5aed73ee59c710d19c711cc360eed010b3176973369c7f329ab6964946078df8c38159adef428680f42836edc773bfb8455cad25be404082ad51c4c0b

    • SSDEEP

      24576:6AHnh+eWsN3skA4RV1Hom2KXMmHa1LodOtZQo4CPAuK85:Nh+ZkldoPK8Ya1sdOtZzPL

    Score
    10/10
    agentteslacredential_accessdiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks