Overview

overview

10

Static

static

5

RFQ #03664...df.exe

windows7-x64

10

RFQ #03664...df.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    09102024_1007_08102024_RFQ #03664710859027pdf.gz

  • Size

    838KB

  • Sample

    241009-l54yxsxgmr

  • MD5

    9ebc6ddf8d47a5f16d19afac78000d9b

  • SHA1

    eb35d73bd598a53bfba954d9716a1bf70dd55f24

  • SHA256

    4e999009b4f3fc1515c25792db41045aaa16f396e7be5de9b28688824001e9bc

  • SHA512

    d6633208514462b3017d5279d7f43594bcfee9fa4656ed26bcb878cfaa73b2c40be669c7ec4d6b502d141c6c9397d0545eecb50212105d077d60b5fa28a5b4f6

  • SSDEEP

    24576:5xC6JWwL5TWrML97mvwYnRIvF/SkIArvoSSq/o:5xjZWIJmY2cSkIqoSVA

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      RFQ #03664710859027pdf.exe

    • Size

      1.1MB

    • MD5

      88812311cbff6bab5d756b3b130e551e

    • SHA1

      9b37df7a0b6bf1d1ed75368133f11bbcd89b71b3

    • SHA256

      b3c89f0bcc8afc69982ea701a95090b4cbba55fa66dd182e0da29204382f30da

    • SHA512

      683ecd5d3ce4a6404077ef7225e30be3f092b74f1535cd21164d830f6051809d59f14b8ddc59b46c79a56b05ef5e1f2b1a56356dc8b542a6f86ba7eaefbfc321

    • SSDEEP

      24576:ffmMv6Ckr7Mny5QLKmFwehb0xNfuwWArnoi+402:f3v+7/5QLKmeu6uwWgoiJ9

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks