Overview

overview

10

Static

static

3

e8f3360290...18.exe

windows7-x64

10

e8f3360290...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e8f336029073f9fbec4183ebcd0df902_JaffaCakes118

  • Size

    786KB

  • Sample

    240918-mw2ymswfrd

  • MD5

    e8f336029073f9fbec4183ebcd0df902

  • SHA1

    93961d10eb0851acc9e011fdf5a4d0b83072c818

  • SHA256

    2d0e1452fd249ffbccbec69dd308c98034cc0d962ddeaa9828a3fff618c4aedd

  • SHA512

    929af6250bb00e467183ec188fd01f2cc64498d1d1f388765a38a01513f200c98b62b42ee0f71015c66c244f16cd7a869cbfe42c2a2096fc23162145bc3b4c64

  • SSDEEP

    12288:K5hwZ2zQdgjNA+JQufx8nNs7XzlsOVEKioR4Hv4n0iRn4lJP4gBKAqyoQc9Cia07:K5hBNNyOVEruZbD

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      e8f336029073f9fbec4183ebcd0df902_JaffaCakes118

    • Size

      786KB

    • MD5

      e8f336029073f9fbec4183ebcd0df902

    • SHA1

      93961d10eb0851acc9e011fdf5a4d0b83072c818

    • SHA256

      2d0e1452fd249ffbccbec69dd308c98034cc0d962ddeaa9828a3fff618c4aedd

    • SHA512

      929af6250bb00e467183ec188fd01f2cc64498d1d1f388765a38a01513f200c98b62b42ee0f71015c66c244f16cd7a869cbfe42c2a2096fc23162145bc3b4c64

    • SSDEEP

      12288:K5hwZ2zQdgjNA+JQufx8nNs7XzlsOVEKioR4Hv4n0iRn4lJP4gBKAqyoQc9Cia07:K5hBNNyOVEruZbD

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks