Overview

overview

10

Static

static

5

New_Order_Inquiry.exe

windows7-x64

10

New_Order_Inquiry.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    004f95c04615b2cd52c990de2f965eea5e19bb5deedb4d7cd1c844de07795ce3

  • Size

    650KB

  • Sample

    241119-fq6lba1flj

  • MD5

    74bf3157b1544b97b497800748648211

  • SHA1

    1e768c284a7185e416ea0d4e5c19e65313b326bb

  • SHA256

    004f95c04615b2cd52c990de2f965eea5e19bb5deedb4d7cd1c844de07795ce3

  • SHA512

    016a4eda1ed11ef51a41db85eedb69eced6e47b3e025c228235fafcf5c8dbe1689b508ad43341dd361d71ad98aca32ac6a8361ff75ab07b76353b8d172516bcc

  • SSDEEP

    12288:3lN2g5BZwrAZ41kMuSrp3womOn0+1/tP70wOrGUDsNN764vbI4AJClUo7xok6ESs:3lMg5BZwJ1kMu4md+5d70wAqN75IRVwt

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      New_Order_Inquiry.exe

    • Size

      1.2MB

    • MD5

      0b789b4497c15da5ea8b2d82c4c6e2e0

    • SHA1

      e8f736e18f9147ee08e71f63bd78a2cf132ce794

    • SHA256

      69074195ee6ec19a43f304b8c92a0dcdeeabeb0bcbf8d007ae0dcf6781e487c2

    • SHA512

      a24e171a1e526100337e826ff886fbbf03f3d6269d2ba5beb4444f8e7b9fef2ab3bc5085ead3a303069f3a74db463d0e4693f7fca0a39120bbc2c100656e3c3d

    • SSDEEP

      24576:ztb20pkaCqT5TBWgNQ7aaWqN4SDcGF0Yg6A:wVg5tQ7aaAt5

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks