Overview

overview

10

Static

static

5

Jia Run-Fu...df.exe

windows7-x64

10

Jia Run-Fu...df.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Jia Run-Full_Appointment_Letter_JRP-252432-1.pdf.exe

  • Size

    1.2MB

  • Sample

    241009-f11g2ssdnn

  • MD5

    0d36d52388f8b51c35caae7a95712b92

  • SHA1

    5cbb80d221bab6bb93f6295607227fbbc41a74ec

  • SHA256

    f69aca32b7e5338942443c0d39eaf35da210360ebc4faa4644c380e5b3573a93

  • SHA512

    c3a0248522e7c69a704f291f1cd2946567495ada29c54dc69c2574896bfa15932866def123768a00995c6dc4c9bd7c18a1b41764de8f50e0ecbc9efbad638c39

  • SSDEEP

    24576:ffmMv6Ckr7Mny5QLowVW9IXtPa6Nyf1Drg5iQr1:f3v+7/5QLowsmyfBr3s1

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      Jia Run-Full_Appointment_Letter_JRP-252432-1.pdf.exe

    • Size

      1.2MB

    • MD5

      0d36d52388f8b51c35caae7a95712b92

    • SHA1

      5cbb80d221bab6bb93f6295607227fbbc41a74ec

    • SHA256

      f69aca32b7e5338942443c0d39eaf35da210360ebc4faa4644c380e5b3573a93

    • SHA512

      c3a0248522e7c69a704f291f1cd2946567495ada29c54dc69c2574896bfa15932866def123768a00995c6dc4c9bd7c18a1b41764de8f50e0ecbc9efbad638c39

    • SSDEEP

      24576:ffmMv6Ckr7Mny5QLowVW9IXtPa6Nyf1Drg5iQr1:f3v+7/5QLowsmyfBr3s1

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks