Overview

overview

10

Static

static

5

Purchase Order.exe

windows7-x64

10

Purchase Order.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    129da6d5a72be03fbeb32c78312183994befb1616763670799647d2f256240ff

  • Size

    737KB

  • Sample

    241003-qeptjayalq

  • MD5

    b18212655848d160940d07fed4f3bd61

  • SHA1

    deb96773f1e78625a4fcc56e331ce5192ba3d458

  • SHA256

    129da6d5a72be03fbeb32c78312183994befb1616763670799647d2f256240ff

  • SHA512

    7caf27f828b7b4a21952b0c941be31d3e992eaf044f2bf7579cb74c0062f9424a2955276f4d955e0fe76c59769e6deee32c324194eb5342ab74d75048e8e1e4f

  • SSDEEP

    12288:U+kRxvXoBC+zYqBkcgYY8tf9A7whOJb/qBT2STzlkSHAq6ZckLZ3crK1oKIK9KFw:bExvYBCAkcgYY8jAkOJD2T2Slpf6WwPB

Score
10/10
agenttesladiscoverykeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      Purchase Order.exe

    • Size

      1.1MB

    • MD5

      231e4c689b7b4a7b7ddd4aa4cefb8c25

    • SHA1

      b0dc66891fdf5dd51524a9dd8a1272f34830d851

    • SHA256

      5f9a7f6a183b3966e84173f3ea7fec1ed563e9cd08577d87d523d9f69f66eb8d

    • SHA512

      6e3999f67085b1b5ef2600f4e041eaaa138e087e7d140d7e6e27b97e8915cfd8b131a136f708c67837ad430c51535f9b9c769b9acca4c300a93cd54048235131

    • SSDEEP

      12288:ULkcoxg7v3qnC11ErwIhh0F4qwUgUny5QNrJqBgqbMADUCBEX0t+rYHWlcuoyFhv:KfmMv6Ckr7Mny5QtYSbJCiXeVZiGPxE

    Score
    10/10
    agenttesladiscoverykeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks