Overview

overview

10

Static

static

5

PO.exe

windows7-x64

10

PO.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PO.exe

  • Size

    1.1MB

  • Sample

    241011-p8m2cstbpf

  • MD5

    f97182496a9a556473b4dcc2317857d1

  • SHA1

    f856b5282b99c167fe84f4afcbe039da8e68aeeb

  • SHA256

    7da29ed5d5ef8e13d8b5631ea4d2868d71721dae0297b260573a877bad180528

  • SHA512

    20192ef9317c31dfd51c90d7abb63e508b30571fe50f2ed637d5250858686ddb7f5b3187bfb06d7cb2755e2b8c5fdce1d7f5e675c25212bc788e4cae5ee37843

  • SSDEEP

    12288:rLkcoxg7v3qnC11ErwIhh0F4qwUgUny5QLRy2CCm5joPd6y9gd3iNZvW4k3+mIZa:ffmMv6Ckr7Mny5QL9CCmhvNMZv2O0

Score
10/10
agenttesladiscoverykeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      PO.exe

    • Size

      1.1MB

    • MD5

      f97182496a9a556473b4dcc2317857d1

    • SHA1

      f856b5282b99c167fe84f4afcbe039da8e68aeeb

    • SHA256

      7da29ed5d5ef8e13d8b5631ea4d2868d71721dae0297b260573a877bad180528

    • SHA512

      20192ef9317c31dfd51c90d7abb63e508b30571fe50f2ed637d5250858686ddb7f5b3187bfb06d7cb2755e2b8c5fdce1d7f5e675c25212bc788e4cae5ee37843

    • SSDEEP

      12288:rLkcoxg7v3qnC11ErwIhh0F4qwUgUny5QLRy2CCm5joPd6y9gd3iNZvW4k3+mIZa:ffmMv6Ckr7Mny5QL9CCmhvNMZv2O0

    Score
    10/10
    agenttesladiscoverykeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks