Overview

overview

10

Static

static

5

YMLUI27516...BL.exe

windows7-x64

10

YMLUI27516...BL.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    YMLUI275163148 - BL.exe

  • Size

    1.1MB

  • Sample

    240912-p7h11swbkh

  • MD5

    efeb57a449ccc8158f1c4ae374b62959

  • SHA1

    d097f10d18f72a86ad3406311163606d5668b520

  • SHA256

    79951afadbd96fb9b16f3d4fe5564e83cca60628082262752d243f0c30d145e2

  • SHA512

    060341f86969d0bf7461925f9d937b780b480ab784daadafa9788b4d75d57ac44bee990ed282b3bac66cbeb4663f4c09619138186553c3704d625f2f3634d7c9

  • SSDEEP

    24576:U4lavt0LkLL9IMixoEgeaVrgVTlY03AroJUEGq9MmCS:jkwkn9IMHeaV8TmzroYaPCS

Score
10/10
agentteslacredential_accessdiscoverykeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      YMLUI275163148 - BL.exe

    • Size

      1.1MB

    • MD5

      efeb57a449ccc8158f1c4ae374b62959

    • SHA1

      d097f10d18f72a86ad3406311163606d5668b520

    • SHA256

      79951afadbd96fb9b16f3d4fe5564e83cca60628082262752d243f0c30d145e2

    • SHA512

      060341f86969d0bf7461925f9d937b780b480ab784daadafa9788b4d75d57ac44bee990ed282b3bac66cbeb4663f4c09619138186553c3704d625f2f3634d7c9

    • SSDEEP

      24576:U4lavt0LkLL9IMixoEgeaVrgVTlY03AroJUEGq9MmCS:jkwkn9IMHeaV8TmzroYaPCS

    Score
    10/10
    agentteslacredential_accessdiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks