Overview

overview

10

Static

static

3

696a1a956d...60.exe

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1samples.zip

  • Size

    952KB

  • Sample

    241015-z11ycsxcph

  • MD5

    d19ee051bde9314a68fffa3349b68088

  • SHA1

    9c9eec6ea49ae31544f14f2cdd28dcfa5a047294

  • SHA256

    449acbaae02e15549117d2b5d5b6bf58a68d4c5deb898ce146e9382ae59cc97c

  • SHA512

    c95678c842f73fae93a0ec97735ef5f187a574766af29b6581ce5b9d89297ad24179be07af8c1447973fa4548773bfa9d165a29383ed27b93a17c3742bbc6113

  • SSDEEP

    24576:XQO6d0cuMpSzOBGZPVq7M56fbQ2wfsYU3ZVQTjlJ0j:gldZncpmIIfbQns5fwlJ0j

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      696a1a956d00c895f0716efdec49515d65deae2edd12cad87c13c29f31fbd360

    • Size

      1.2MB

    • MD5

      e0d57a92476711a3438a44fa205e1720

    • SHA1

      a1669d33a5b53f9c501c01ec2bc7e155a6964a38

    • SHA256

      696a1a956d00c895f0716efdec49515d65deae2edd12cad87c13c29f31fbd360

    • SHA512

      7f6173a7d61dc797fc63456240b26daca47580ca901e3af901926fe293ab703c83b1c1f7fb5e47378d42d3443524db13707283018699e76e1dd5de2aae1a80e9

    • SSDEEP

      24576:I3c92psKAq6ITV5vGbao8LSEI28uUESJVufn/VtvVE:I3cYaKd6EGbrs4ySQ

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks