Overview

overview

10

Static

static

5

Statement ...df.exe

windows7-x64

10

Statement ...df.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    85aab885df90a93b9200cbadb8b3351bf8be272a2a5cc6987a577942e611e66d.rar

  • Size

    703KB

  • Sample

    240912-b6qgtavdkd

  • MD5

    2d2e98092e2b063e3f77dffb7bcf080d

  • SHA1

    e7d50f3da70d0356abf3ceac4bc0a8aff0e1e2d5

  • SHA256

    85aab885df90a93b9200cbadb8b3351bf8be272a2a5cc6987a577942e611e66d

  • SHA512

    6e31cc683f09f48bc80749e457c278ef94ac79d4d3f4455c6181a34fa50de45e90f269cf1c727ffa37777c720f35d727a87329e2a09f41ee780d13549525530a

  • SSDEEP

    12288:ZSbDZu6O7o8Bkn9GVGHOUIIXLRMzBI5XK2R9rCajr1IMgJc1Uj428BFCStm/xiGq:ZgzO7o8SnHtpNMzB4aY4an1IHJcicCsl

Score
10/10
agentteslacredential_accessdiscoverykeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      Statement of Account as of AUGUST 2024SOA.pdf.exe

    • Size

      1.2MB

    • MD5

      ddbaaa52ea1192377573a76e4ac8fb7b

    • SHA1

      0c86f1126bde5a0ab4d5dc8eb2e7aeb8b824d474

    • SHA256

      4122f1d85ffb12401925c52470a6a3f4cc75e02546069894ed33ce7a6dd81897

    • SHA512

      9c01f8e5aed73ee59c710d19c711cc360eed010b3176973369c7f329ab6964946078df8c38159adef428680f42836edc773bfb8455cad25be404082ad51c4c0b

    • SSDEEP

      24576:6AHnh+eWsN3skA4RV1Hom2KXMmHa1LodOtZQo4CPAuK85:Nh+ZkldoPK8Ya1sdOtZzPL

    Score
    10/10
    agentteslacredential_accessdiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks