Overview

overview

10

Static

static

5

Invoice.exe

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Invoice.r15

  • Size

    729KB

  • Sample

    241014-m2gjwsycnk

  • MD5

    eec522c2f1b6854fc74e713de93d89d5

  • SHA1

    af4738ee935b1bc89946a38a4e720bdb8c619d51

  • SHA256

    c89b68aa483644fb693accb9a25dc84c202c9e971562b87ebbb7b5177941704e

  • SHA512

    0b64f23a64c3cc71c5aecf7f8c35e5ab80490dab29d84c041cc35ef5d507a0d73a9a76f9afceef96815e8a736e0424485d1152525405b65339c6994e0f897ef6

  • SSDEEP

    12288:upQumzeyAhHFqalUMXcAStHwIrdmQWi/pSS2lu7DyjyyOcCAAXGak6ag6:4QE7NFqah7SXmQWyUru7DyHO1AAWakG6

Score
10/10
agenttesladiscoverykeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      Invoice.exe

    • Size

      1.1MB

    • MD5

      3a60ee2ac533387925bc447e17710bf5

    • SHA1

      2c6bc2839eaca6f3dbe43568940a7dff2b1ea902

    • SHA256

      097c7472803e5dca675ac074c1092848ae92cb468447eb8d0b57afe392c156ad

    • SHA512

      6ed90eb31c4dd83e408bcca99db9313a6d465af2e909b873549c526cfe776574a5d1861a05ef7666dec998db069030f84d1cce26a9648c3103b9ded15b2a2661

    • SSDEEP

      24576:ffmMv6Ckr7Mny5QL1jCfcqTVfA7JE9k2u7acVa:f3v+7/5QL1j6TVfA7+9juacVa

    Score
    10/10
    agenttesladiscoverykeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks