Overview

overview

10

Static

static

3

New Purcha...SE.exe

windows7-x64

3

New Purcha...SE.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c2303814ea82a0de58a5c5f8ad81b065c55d91633429634b358ece628f0988d8

  • Size

    3.6MB

  • Sample

    241120-by5lrsyamn

  • MD5

    333aac06577cf5eaa9fa4acc9373b854

  • SHA1

    4d902c7391cba4d5004ecfcee4d6bbe99e7fb1cb

  • SHA256

    c2303814ea82a0de58a5c5f8ad81b065c55d91633429634b358ece628f0988d8

  • SHA512

    f9060559874b84ee08afb47a98b6a4f9f715585932a1ebe7afdb2b56c4354ea23a6fddc58e983cc0c4f87d7ca38785759b419720260fb52cb4a09170cbaf27fb

  • SSDEEP

    98304:7i2Bjtbts27BHy6e9YhcOZiuM6cghJ/Ah2r1SBpH6cde+J2:7b1tbuI+qiu9cghJ/X8BQcwv

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      New Purchase Order Document for PO1136908 000 SE.exe

    • Size

      7.1MB

    • MD5

      9b2c361b77d2a5198602a24b473b506a

    • SHA1

      01a4beda7991a7d5ad9717e25e3d47d219dec1f9

    • SHA256

      9ebb6978d40e7e5870ee40d426ccc6cf7eff686b5d95375399c6d15388067f0d

    • SHA512

      3fb44a807dc6bc1aaf97f7a39b06a870d1f8d19429cd699b1839ee4233d1267ab3fac535255b49d07d32937e79df888c1e75c52a725405b416ed99236465741e

    • SSDEEP

      98304:YlaHVJHFOv9GJ6RiiOPriSL+pMI6cNKu4X2XfQ9rr6YrxV:ZHzFOvcOS0MRcNz4mI9qYtV

    Score
    10/10
    discoveryagentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Executes dropped EXE

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks