Overview

overview

10

Static

static

5

MAVI VATAN...cx.exe

windows7-x64

10

MAVI VATAN...cx.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    MAVI VATAN - VSL's DETAILS.docx.exe

  • Size

    1.3MB

  • Sample

    241007-j3vw5avekp

  • MD5

    dba0bc53f2016c57be7d0dadfaa17fb8

  • SHA1

    b8554ce67552eef9c8ea2ea8dfdb7b74548c3a14

  • SHA256

    7e721239fe3d73446b187b5b0a3d40671b5d6e272187dddc6ccf81ffd1a1f310

  • SHA512

    789482ed430435ad440fec1fec266efb913e2bdebcad4275ae0e396a215107e3675c7a4bc135ceb37e7c34b3432b6c85eae04837e2c9fc7a00b4ff0368148dcb

  • SSDEEP

    24576:kfmMv6Ckr7Mny5QYeZbF5Qw2p51P08VoNFWkimu5O+m3:k3v+7/5QYelfDM5Z0MoNFWRQ7

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      MAVI VATAN - VSL's DETAILS.docx.exe

    • Size

      1.3MB

    • MD5

      dba0bc53f2016c57be7d0dadfaa17fb8

    • SHA1

      b8554ce67552eef9c8ea2ea8dfdb7b74548c3a14

    • SHA256

      7e721239fe3d73446b187b5b0a3d40671b5d6e272187dddc6ccf81ffd1a1f310

    • SHA512

      789482ed430435ad440fec1fec266efb913e2bdebcad4275ae0e396a215107e3675c7a4bc135ceb37e7c34b3432b6c85eae04837e2c9fc7a00b4ff0368148dcb

    • SSDEEP

      24576:kfmMv6Ckr7Mny5QYeZbF5Qw2p51P08VoNFWkimu5O+m3:k3v+7/5QYelfDM5Z0MoNFWRQ7

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks