Overview

overview

10

Static

static

5

MAVI VATAN...cx.exe

windows7-x64

10

MAVI VATAN...cx.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    MAVIVATANVSLsDETAILS.docx.z

  • Size

    938KB

  • Sample

    241002-y6qh5sycjc

  • MD5

    fdd39bbbef7c737d568a9201e9d99fb9

  • SHA1

    a6f561e7f48812a81827ca0d4817e2fd1721f91d

  • SHA256

    7c32b2a1112991ad20f8d6ac1486e9dade017a84ef12bb99e1e2330efcdd0524

  • SHA512

    de4e4ef616a2287feb08b788e88de5672e18e1c25748230a13495be2f04f0466b643703ebf47fdc94c9cf67c244c6bc281463a4d8f45e168eb8a2b6ef2eec1c9

  • SSDEEP

    24576:e85hgTaXBFra4jVddpLMSGryRcZ7kDlQhxynFqf:e87PXPa0VvuHrccZwDdnF4

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      MAVI VATAN - VSL's DETAILS.docx.exe

    • Size

      1.3MB

    • MD5

      dba0bc53f2016c57be7d0dadfaa17fb8

    • SHA1

      b8554ce67552eef9c8ea2ea8dfdb7b74548c3a14

    • SHA256

      7e721239fe3d73446b187b5b0a3d40671b5d6e272187dddc6ccf81ffd1a1f310

    • SHA512

      789482ed430435ad440fec1fec266efb913e2bdebcad4275ae0e396a215107e3675c7a4bc135ceb37e7c34b3432b6c85eae04837e2c9fc7a00b4ff0368148dcb

    • SSDEEP

      24576:kfmMv6Ckr7Mny5QYeZbF5Qw2p51P08VoNFWkimu5O+m3:k3v+7/5QYelfDM5Z0MoNFWRQ7

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks