Overview

overview

10

Static

static

3

cd871d0209...fb.exe

windows7-x64

10

cd871d0209...fb.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cd871d020967aa6507d10b2df647134b50fe33aecb3c2d624183a7cc1e60d4fb

  • Size

    850KB

  • Sample

    241212-bf62wazjbl

  • MD5

    c705b1d5976770c8290c7588dff07280

  • SHA1

    28eb0ae8dec3ef246e9b2831cf41a26126ec8786

  • SHA256

    cd871d020967aa6507d10b2df647134b50fe33aecb3c2d624183a7cc1e60d4fb

  • SHA512

    cf9ab7a2675328afde05a760394ee97a5e5ef8272a566e2c440aff6710d45763ca314ab9e47e35a583049ba860f6f228fbf1203f4e058d267e7df60f555e2ced

  • SSDEEP

    24576:qEKqMWIsnlFIiT3wGRZjiAlzAl/evOv9WgQ56fum:WSUn+8AlzAte2

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    smtp.privateemail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    rainybanda@11

Targets

    • Target

      cd871d020967aa6507d10b2df647134b50fe33aecb3c2d624183a7cc1e60d4fb

    • Size

      850KB

    • MD5

      c705b1d5976770c8290c7588dff07280

    • SHA1

      28eb0ae8dec3ef246e9b2831cf41a26126ec8786

    • SHA256

      cd871d020967aa6507d10b2df647134b50fe33aecb3c2d624183a7cc1e60d4fb

    • SHA512

      cf9ab7a2675328afde05a760394ee97a5e5ef8272a566e2c440aff6710d45763ca314ab9e47e35a583049ba860f6f228fbf1203f4e058d267e7df60f555e2ced

    • SSDEEP

      24576:qEKqMWIsnlFIiT3wGRZjiAlzAl/evOv9WgQ56fum:WSUn+8AlzAte2

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • AgentTesla payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks