Overview

overview

10

Static

static

1

Ref_5010_103.exe

windows7-x64

6

Ref_5010_103.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    666dacfe6f5bbfee2b2d78be46ee9650c4c5ce35c3cba0cd0ce0d323db11e8ac.7z

  • Size

    42KB

  • Sample

    240924-btzvqawame

  • MD5

    38740789711151feea9eac11fa3f33a3

  • SHA1

    0c0d7d6e21838334a7b2e7a0c998e816793278dd

  • SHA256

    666dacfe6f5bbfee2b2d78be46ee9650c4c5ce35c3cba0cd0ce0d323db11e8ac

  • SHA512

    afe4ed916531734353501b6ec51d662b52477c456d394d9b2b0a71b182bf57914ac2634276b06db6e713cee0e745bcbe9452bfe086717a331db1eb39542e5f4b

  • SSDEEP

    768:YYiUOz8+yiqIfm4ta94uAfhNhXtHpk0W0oWrc1FN8/+rrfL2P6rWRV4rKI:YVlzZfahA5NhXtHR17AB8WvKPY6V4rKI

Score
10/10
agenttesladiscoverykeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      Ref_5010_103.exe

    • Size

      420KB

    • MD5

      3e55d9e05940e5c6073b8dc09256b6b9

    • SHA1

      335d4658fa98dc92dc2f7831b0855c6b3504fbf1

    • SHA256

      adf712d2eebe5e066d7cd535c0d88ff08ee2f735e21fbd68bcf71ce20276309b

    • SHA512

      6fdb095c0877e0c942a78938e5424a2154aa49c5ef1c7b5bbd7eba11bfcb4ef829b99344487ce6547ed66da73264b304de6328403d343dd0ef851b27b1b9d31d

    • SSDEEP

      1536:k8mCCCCCpCCCCCTdvCCCCCCCCCCC3CCCCCCCCfFIeCCCCCCCCCCCCCCCCSCCCCh8:pCdsP6GBxhDCoxzU/s

    Score
    10/10
    discoverypersistenceagentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks