Overview

overview

10

Static

static

5

01. VESSEL...df.exe

windows7-x64

10

01. VESSEL...df.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    01.VESSELsDESCMV.DEMAM.pdf.lzh

  • Size

    1006KB

  • Sample

    241002-tw1h5szbmc

  • MD5

    54ba5fb14eaca80cdb3dffbd695c8323

  • SHA1

    b25d73a9b376ff27b47614a11a6aeda333a964c4

  • SHA256

    9a173d0d22bdb22ef1ef9b95a28558e8204c9a28e4c91074edb904a8286956c7

  • SHA512

    75ef17757301040c3829bc7809b9663b2a79feb2bbf1f017997e846119ba39ebf83137ddff2d70b8fa989ae3c30b47ff9271f47038e67fe23253a252f48d0b69

  • SSDEEP

    24576:Q2GSWOY516HV5ea88PdswJmrzOAPWsXSXgpwut61:Q2mOY51sI2mrzOgWW0gLt61

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      01. VESSEL's DESC - MV. DEMA M.pdf.exe

    • Size

      1.3MB

    • MD5

      bac4a8bde93ef7323e06c9303c80b365

    • SHA1

      2fb18b7e433f608ef2c0e3b8839159f0cda39f84

    • SHA256

      b46023ecb26400931b352ddb0e4626d550065ce5b5380ced9f6c1619fbc96548

    • SHA512

      2fc861df6889edab7fe25107d3bb3a30e4ecefe8c458add1de33c69af47686a7c880823307bfc1a6032469ed480f689c31e6ca4130c4744d53d10b1a211d8381

    • SSDEEP

      24576:kfmMv6Ckr7Mny5QYeZbMSpE4S4BSm0dCwVzRO5ztD8Zlq1fJZf:k3v+7/5QYel1pLSIQCAMUZlq1fP

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks