Overview

overview

10

Static

static

5

Order PI.exe

windows7-x64

10

Order PI.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4e61c8a7fcede8607f371eba40461c8f4f909e3458298e005e3ceddf23807b7b

  • Size

    560KB

  • Sample

    241119-bx2hqaybje

  • MD5

    f9b81023a010a2bddb2dd2168ae53d09

  • SHA1

    b1dec5785e2cc873f0599fb61db47be98c42246f

  • SHA256

    4e61c8a7fcede8607f371eba40461c8f4f909e3458298e005e3ceddf23807b7b

  • SHA512

    cccb117dab5956c47244d36cf4beb1fdf93339ebe57c1c240c746e6d0eb0090b5e5a6ae095e619cd5ea9ea4bc631feb241e4245f22cc3c02fa9ef5722c2789fb

  • SSDEEP

    12288:iSsbeT6SCgdMmyC6Nsrs/WWvgqOvgkiTn:iSeGdSC6z/jYq5/j

Score
10/10
agenttesladiscoverykeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      Order PI.exe

    • Size

      1.0MB

    • MD5

      7325e28419a4e0c1fc618e7c06cf5d04

    • SHA1

      3d4fc64e126ecec5b0fe64d16111e3d7a8efb38d

    • SHA256

      504766855e429d9660c65e2d2543aba91cfbfc0c45b4a68540a36427435be76c

    • SHA512

      07024e8a9dd69017976820b685e2ede222965261d4e6b22033df3f5642821471780a4077edf5e009be99783d6dbefaddc4670807466f98461285c724623fc3b4

    • SSDEEP

      24576:Mtb20pkaCqT5TBWgNQ7aL43nCoqlwuZQytrv6A:1Vg5tQ7aLMCoqlvZQ4L5

    Score
    10/10
    agenttesladiscoverykeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks