Overview

overview

10

Static

static

5

5876cfa9e9...8N.exe

windows7-x64

10

5876cfa9e9...8N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5876cfa9e9c72409289708507dd21d3957b234d652b24cf790180bdd378668a8N.exe

  • Size

    35KB

  • Sample

    240925-v4npzsxgln

  • MD5

    5c4c6880f93b58fe59fb1bee1c556380

  • SHA1

    b7c9b337ab5f89c81006aad1e5abcb7486b1e646

  • SHA256

    5876cfa9e9c72409289708507dd21d3957b234d652b24cf790180bdd378668a8

  • SHA512

    05e12f068bbd32c85eb740f83e4dc178db49b218bdc9d748beac7c5a3f94f648f3f1b8eb2c4f8e53d3cf0ea7452ef26647a39396b5e0ed8778e07ac16b1b4f1c

  • SSDEEP

    384:XZirz04kYcm5oRVPUn30CDG1iZMJSalHXeqZhsWIgDWsjxZUtO4f54A:Mi+5uVPUn30gGEZQH5SAXJ4f54A

Score
10/10
agenttesladiscoverykeyloggerpersistencespywarestealertrojanupx

Malware Config

Targets

    • Target

      5876cfa9e9c72409289708507dd21d3957b234d652b24cf790180bdd378668a8N.exe

    • Size

      35KB

    • MD5

      5c4c6880f93b58fe59fb1bee1c556380

    • SHA1

      b7c9b337ab5f89c81006aad1e5abcb7486b1e646

    • SHA256

      5876cfa9e9c72409289708507dd21d3957b234d652b24cf790180bdd378668a8

    • SHA512

      05e12f068bbd32c85eb740f83e4dc178db49b218bdc9d748beac7c5a3f94f648f3f1b8eb2c4f8e53d3cf0ea7452ef26647a39396b5e0ed8778e07ac16b1b4f1c

    • SSDEEP

      384:XZirz04kYcm5oRVPUn30CDG1iZMJSalHXeqZhsWIgDWsjxZUtO4f54A:Mi+5uVPUn30gGEZQH5SAXJ4f54A

    Score
    10/10
    agenttesladiscoverykeyloggerpersistencespywarestealertrojanupx

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks