Overview

overview

10

Static

static

5

CHARIKLIA ...df.exe

windows7-x64

10

CHARIKLIA ...df.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    97662e648efd892f1e00769e65c2fb3c673d28275060ecab581ac57ed878044c

  • Size

    667KB

  • Sample

    241123-cccvas1lcj

  • MD5

    b2109e95b3a27a5941ac7773bc57dae8

  • SHA1

    e1065564cd27153c5af94f1cd8cd93d84daa490c

  • SHA256

    97662e648efd892f1e00769e65c2fb3c673d28275060ecab581ac57ed878044c

  • SHA512

    dda570533ba7ec65fd4807f0b0f3ee803218ed642a4e0841f695e91d48763dfb355b0c4305859f945cbb64035acbbfb1554a527598732c0b439b200dc8b5373f

  • SSDEEP

    12288:/saJBYCt5V6QbqCiYlsVxZrDCO12B3CcTspngcC0Z8CuFEG7tBHTzyzj:/tYYBb8YKxkO1CRggcZ89Bxl/yzj

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      CHARIKLIA JUNIOR DETAILS (1) (1).pdf.exe

    • Size

      1.1MB

    • MD5

      1ca01a88b80112024883e55a27b1345a

    • SHA1

      3fdcd8cd1ff882b9c76dd93f680bb7f60fc97c7d

    • SHA256

      a848e5d8d3a080b81556f4f7ec1fe1103610bf7bbb023065bf2e6696abaf6769

    • SHA512

      9f978fe421c5217bccf787df0a105f584cd945be1f43e77f1971d688becaa9682a01acf7585b6bcaf4111103835dbcaa2caef59ccd393a16360cedebfb891125

    • SSDEEP

      24576:Xtb20pkaCqT5TBWgNQ7aaGNhHYefDINn9Zr3qH6A:UVg5tQ7aaaHYaEN9K5

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks