Overview

overview

10

Static

static

5

PO-A1702108.exe

windows7-x64

10

PO-A1702108.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    08102024_1354_08102024_PO-A1702108.tar

  • Size

    883KB

  • Sample

    241008-q7zjfatcnh

  • MD5

    7b0308945254da641471f92241861462

  • SHA1

    83691e6aac6d564e2034f5db955fd8c8d7622895

  • SHA256

    98d48614dfcdd17411511930a7a5c5138c38e09c03ac3f53ddd560e994e51fe5

  • SHA512

    468266d70a0d534903d95b42b6704e346f900f913761a60f18bfdff276308cbb8fd4fb3bed057a9aca2e2b1db710391f55b3e8fb72038e36045dce58a0dae2d3

  • SSDEEP

    24576:9QE7NFqah7S4Mz0rupg4EAeKuk4nH+DHWGPyB3:JNFFe5zfpgXkWH+TpPy5

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      PO-A1702108.exe

    • Size

      1.2MB

    • MD5

      e3eee7377eba76e0929864fd08ef3628

    • SHA1

      a6fa1f8496f975acc822eb574139a75a28bc61c6

    • SHA256

      5367636e08ae00354a1bfdabdc3adde3d0421130d7c601bd2faa9e2d310279ec

    • SHA512

      65e2ec420571b71ed5238e2e388a887d0aef2f6728c9ee6665ef4047454510bc7fca441989cc6689f4effd280b192cf7f6592e7ee88a105b09cf9a35757c8f7e

    • SSDEEP

      24576:ffmMv6Ckr7Mny5QLGOdfmMJGj8vMpCei9Nuy:f3v+7/5QLcr8Epfi9Nuy

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks