Overview

overview

10

Static

static

5

9d954b672f...cd.exe

windows7-x64

10

9d954b672f...cd.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9d954b672fcd0b4e6bdf5e34f0c27e8a8dd6e0984d28cfa27924dee457f34fcd

  • Size

    1.1MB

  • Sample

    241120-bvs4kaskfk

  • MD5

    e53eaa2914dc091f2e146b5665775eaa

  • SHA1

    e7431b4b6bd6ab4e55e5cea816407f4a22c733d8

  • SHA256

    9d954b672fcd0b4e6bdf5e34f0c27e8a8dd6e0984d28cfa27924dee457f34fcd

  • SHA512

    bd423afa7de723633c546eeb2dd152e1255f561326b44968ebee93a2dc24a8b211dd6227aa40a6033c3d1169b66df9947977665b49abca84b7857d4d5a28654f

  • SSDEEP

    24576:vtb20pkaCqT5TBWgNQ7aD9FUqHPD9CUZ0GxiVUW6A:sVg5tQ7aD7UqH5zmGQp5

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      9d954b672fcd0b4e6bdf5e34f0c27e8a8dd6e0984d28cfa27924dee457f34fcd

    • Size

      1.1MB

    • MD5

      e53eaa2914dc091f2e146b5665775eaa

    • SHA1

      e7431b4b6bd6ab4e55e5cea816407f4a22c733d8

    • SHA256

      9d954b672fcd0b4e6bdf5e34f0c27e8a8dd6e0984d28cfa27924dee457f34fcd

    • SHA512

      bd423afa7de723633c546eeb2dd152e1255f561326b44968ebee93a2dc24a8b211dd6227aa40a6033c3d1169b66df9947977665b49abca84b7857d4d5a28654f

    • SSDEEP

      24576:vtb20pkaCqT5TBWgNQ7aD9FUqHPD9CUZ0GxiVUW6A:sVg5tQ7aD7UqH5zmGQp5

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks