Overview

overview

10

Static

static

5

a0ce83972e...57.exe

windows7-x64

10

a0ce83972e...57.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a0ce83972e16b826fc209b7272260aa7ca67b58cec13fb62c5285bde3ab7a257.exe

  • Size

    1.2MB

  • Sample

    241008-pwpdna1dqa

  • MD5

    2b2832a4e1bf4e26e59980f4162334e2

  • SHA1

    a9ae9ed9b7804a21fc0cf1e6b0d7d2e9f18b8336

  • SHA256

    a0ce83972e16b826fc209b7272260aa7ca67b58cec13fb62c5285bde3ab7a257

  • SHA512

    26fc4677d42d3c0dae70a0f5c8c8e0987bac137d94d6973883de48c3de028424e77c2227d14b4d59b9eafe097a5e3dde29d275fbe1de3ce7fe880d4496228f01

  • SSDEEP

    24576:uRmJkcoQricOIQxiZY1iaCznZeX4CCmLFtyfHIHjw3Oz/ijaX:7JZoQrbTFZY1iaCznMCiFtygHcOTN

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      a0ce83972e16b826fc209b7272260aa7ca67b58cec13fb62c5285bde3ab7a257.exe

    • Size

      1.2MB

    • MD5

      2b2832a4e1bf4e26e59980f4162334e2

    • SHA1

      a9ae9ed9b7804a21fc0cf1e6b0d7d2e9f18b8336

    • SHA256

      a0ce83972e16b826fc209b7272260aa7ca67b58cec13fb62c5285bde3ab7a257

    • SHA512

      26fc4677d42d3c0dae70a0f5c8c8e0987bac137d94d6973883de48c3de028424e77c2227d14b4d59b9eafe097a5e3dde29d275fbe1de3ce7fe880d4496228f01

    • SSDEEP

      24576:uRmJkcoQricOIQxiZY1iaCznZeX4CCmLFtyfHIHjw3Oz/ijaX:7JZoQrbTFZY1iaCznMCiFtygHcOTN

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks