Overview

overview

10

Static

static

5

PO-A1702108.exe

windows7-x64

10

PO-A1702108.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    C0R566573T91513557.eml

  • Size

    1.2MB

  • Sample

    241008-hnljgatgjk

  • MD5

    46f6aa31b509938be8741be5b5e4c078

  • SHA1

    0bc7b6ed107abc2a0747d7598412d7a603664810

  • SHA256

    e79b178fc9b4872c8d911cc276ace2b63e28f1fb622f943a132509de7c82e7fc

  • SHA512

    110ad70aff6f5d10ef26a5790fbeca7a8d991af7cdf11cd786df6c06ef9ca0f114369f20e4d693501bef9ccd5c48f039233bc6c4e2be59b437129f68d7abd6ec

  • SSDEEP

    24576:Gw1SabxrNmPJP824Oq91lXav+jwmmJPZrim9uROetT0GQtEXk:I0OiloEtPbk

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      PO-A1702108.exe

    • Size

      1.2MB

    • MD5

      e3eee7377eba76e0929864fd08ef3628

    • SHA1

      a6fa1f8496f975acc822eb574139a75a28bc61c6

    • SHA256

      5367636e08ae00354a1bfdabdc3adde3d0421130d7c601bd2faa9e2d310279ec

    • SHA512

      65e2ec420571b71ed5238e2e388a887d0aef2f6728c9ee6665ef4047454510bc7fca441989cc6689f4effd280b192cf7f6592e7ee88a105b09cf9a35757c8f7e

    • SSDEEP

      24576:ffmMv6Ckr7Mny5QLGOdfmMJGj8vMpCei9Nuy:f3v+7/5QLcr8Epfi9Nuy

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks