Overview

overview

10

Static

static

1

6f63c579d6...27.exe

windows7-x64

10

6f63c579d6...27.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6f63c579d6602b9cf683cfe5f24a46db07491ea23703d83ccebff4829fa78227.exe

  • Size

    3.6MB

  • Sample

    240928-bvvmdszcqm

  • MD5

    62e11691c457a43738b01faca500f688

  • SHA1

    341a62aad64638762a3d43594e3f0e413e369160

  • SHA256

    6f63c579d6602b9cf683cfe5f24a46db07491ea23703d83ccebff4829fa78227

  • SHA512

    3601e50e282c62ecac88e4b3a727df6cbb7447ba9901a36f6515bd949dde53548d27f7566dca73106163792a2daff9a4bbf59f4fc530ee01d0050fe52256f73e

  • SSDEEP

    12288:iFXhF2Gkx9Mjx/6MEFcfuxPVXsUGeovRJ4Y45S2R0JhAICryO8C/8pod7gO5Qz7/:qbom96CQ1ovHD4pKEICrn8AZQz7/

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      6f63c579d6602b9cf683cfe5f24a46db07491ea23703d83ccebff4829fa78227.exe

    • Size

      3.6MB

    • MD5

      62e11691c457a43738b01faca500f688

    • SHA1

      341a62aad64638762a3d43594e3f0e413e369160

    • SHA256

      6f63c579d6602b9cf683cfe5f24a46db07491ea23703d83ccebff4829fa78227

    • SHA512

      3601e50e282c62ecac88e4b3a727df6cbb7447ba9901a36f6515bd949dde53548d27f7566dca73106163792a2daff9a4bbf59f4fc530ee01d0050fe52256f73e

    • SSDEEP

      12288:iFXhF2Gkx9Mjx/6MEFcfuxPVXsUGeovRJ4Y45S2R0JhAICryO8C/8pod7gO5Qz7/:qbom96CQ1ovHD4pKEICrn8AZQz7/

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks