Overview

overview

10

Static

static

5

Payment Ad...ls.exe

windows7-x64

10

Payment Ad...ls.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    77300ce9fc72383cfaeee158be700d40f4bb7d83d64f26d3cc15296e8dcad056

  • Size

    834KB

  • Sample

    240920-c5a66svflq

  • MD5

    dfb7c0e6635c3f561be3ccf7e538e667

  • SHA1

    a1f9b3d64c73251dff1754f764812b26fe5a7339

  • SHA256

    77300ce9fc72383cfaeee158be700d40f4bb7d83d64f26d3cc15296e8dcad056

  • SHA512

    1fab73e65fba09607d18f52479f8b92f9279b73db137105da7258f3bfd67b1f731b6c0f10a469bc1c27cfbc53eec73648cde37b837b30ed57aae322d584979c2

  • SSDEEP

    24576:1Y7tC/D80olUcTOSuGXhhgevKeJIaAKX3AV:1Ypi80olUcTOGRueFJ6F

Score
10/10
agentteslacredential_accessdiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      Payment Advice details.exe

    • Size

      1.1MB

    • MD5

      d0cad8abc1084efccf82cbe747104c3f

    • SHA1

      fb30f4cb31782c78d24b55071c618070b84c4b4e

    • SHA256

      a17cae5463618c9758dd98802353f8172e343dcad936a44c5f1d1fe5ff7813f6

    • SHA512

      1633f369d0a94f7000403ff7762087923b34fd3292fc27ed3f153aa590fdb29e92eb2429890c9b959625ee7c8e328d95886802225492b1c6e1849e04cceb9eeb

    • SSDEEP

      24576:uRmJkcoQricOIQxiZY1iaCamxvrmQbae7IkAKZt62:7JZoQrbTFZY1iaCamFiQJ7wK

    Score
    10/10
    agentteslacredential_accessdiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks