Overview

overview

10

Static

static

3

Purchase Order.exe

windows7-x64

10

Purchase Order.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dbf95d753a2fedbee7a92a7e40dbcd3cdf655a2d6f1a163bf0c3aeefd1e021dc

  • Size

    584KB

  • Sample

    241211-ahkqzswmbs

  • MD5

    91e76e77f8764bf53ddd77db623d72a5

  • SHA1

    218fc76540fb2983807caf52525eee60746b84ac

  • SHA256

    dbf95d753a2fedbee7a92a7e40dbcd3cdf655a2d6f1a163bf0c3aeefd1e021dc

  • SHA512

    ef261991c8dea262fd99e4300d57d9b800bd5a3b6a5c974bb6eeabe436711144e88a16904ce907d672da158932173fa475191c263f92f3a3b2721498b86086a5

  • SSDEEP

    12288:6Qdb74Mm86QFpeXwlSs/fBPFRH3LpDDCOueaewd/KX8:Z2ZQrSKPFiOulJKX8

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      Purchase Order.exe

    • Size

      588KB

    • MD5

      55ab87ddf0459b1c207d4590f021e854

    • SHA1

      22a3bf9867de027fde4ba06d1e9fd36654a885ce

    • SHA256

      10bfbd96b6b11b5c6be3a51ed9b469a5e7d298d311d16f7ccb30624fac5af8c4

    • SHA512

      77cbd0efa243ebd7b01995271dcea710524432853e68c1c474138f6b619a2505425ef3b1f20518fc7698866371f366c9fae0e032de55180f56188ab856ead0ee

    • SSDEEP

      12288:CumOpyl6zVirdwFghawidFSl1lcegbQx5LPIJ9xxhOBOMkiFjV338O4Od0CgwP8c:nmOQ6zArd8gmdFSlDtg0wJ5QBO/DOdr9

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks