Overview

overview

10

Static

static

5

#29469O204.exe

windows7-x64

10

#29469O204.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    #29469O204.exe
  • Size 1.1MB
  • Sample240916-tym1tsxglk
  • SHA256 2f871dc858b7320d26415f760957201d60691eee8d3939eb2e443a2ee8bad3ef
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
agentteslacredential_accessdiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

  • agenttesla

Credentials

Targets

    • Target
      #29469O204.exe
    • Size 1.1MB
    • SHA256 2f871dc858b7320d26415f760957201d60691eee8d3939eb2e443a2ee8bad3ef
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    agentteslacredential_accessdiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks