Overview

overview

10

Static

static

5

DRAFT BL &...29.exe

windows7-x64

10

DRAFT BL &...29.exe

windows10-2004-x64

5

Sharing

Copy URL
Twitter E-mail

General

  • Target

    197c3cd9ef36800d6aca681a6f475ce0c97c91b7d17e80da331bf19fb87b5288.rar

  • Size

    677KB

  • Sample

    241116-cmbpzsyakm

  • MD5

    3ab5e238329a1a8a9e9b4709e5320195

  • SHA1

    531ff3ad5bc6c6f4d5523bf8a841325475acc146

  • SHA256

    197c3cd9ef36800d6aca681a6f475ce0c97c91b7d17e80da331bf19fb87b5288

  • SHA512

    91b270d5175741aeb38a3f46ced7bd0f9ce866d33c338fe18ef6976975edd73198a3f94b2ce7f40f68a892f6da2ab6e0592111ce83e2581aac16825cf2dbe959

  • SSDEEP

    12288:VC5mxx1ctgWvVNoMZ5bqUJBwHlyDXTFEVUgSMeX1lDxuvarXGVVq:oU71jMZsUL+lXZeX5RGVVq

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojanupx

Malware Config

Targets

    • Target

      DRAFT BL & MBL PO NO ECM1D2403-29.exe

    • Size

      708KB

    • MD5

      e8d3060734bdcba3bd69c4aad8859f80

    • SHA1

      04979e52970b4372e25de9055f3bf97f0ba5ec0f

    • SHA256

      2bcbc525587856ce9d9457b34fc90064e3a4fe77f241e16e8d4e22fde661dceb

    • SHA512

      377837b15eb3500ea5ea5c2cb1e69143ab5d5dccd15d55b6c565481d546e9e6f5b784869b62626585daa704ee6b565b884818fc9fa8c4f4c2096c0a3d573b9fa

    • SSDEEP

      12288:0sHzOUNUSB/o5LsI1uwajJ5yvv1l2IXnQZQFb/m5FUzDxidlNsRexeDNl9:XiUmSB/o5d1ubcv/XQia0zDxi7iIeDN7

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojanupx

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks