Overview

overview

10

Static

static

1

Ref#565771.exe

windows7-x64

7

Ref#565771.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    95bec22f3175f3bccef1cce20724809c95a9ea7b309440e10c58c16e21f98c14

  • Size

    8KB

  • Sample

    241225-bmh9dstjaq

  • MD5

    d02118e316078f31b7703ad632213951

  • SHA1

    66ccf66421a807512372ec404a19bdd6b967499a

  • SHA256

    95bec22f3175f3bccef1cce20724809c95a9ea7b309440e10c58c16e21f98c14

  • SHA512

    a1f5b74ddba3fa8c8210eefa3a34add313a2af959e1c25382dba78da2058ebb5b28457bef13fb3a462b7526662241b92513e39db61b58f684f545cbf571aeec9

  • SSDEEP

    192:GH6pefGQKptdgAMZ5k8Je7MOf7exJErhYYDaKqyDff4uKaCln:M3GQALAelfqIhraKffwuK/ln

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      Ref#565771.exe

    • Size

      30KB

    • MD5

      ed236267c78420804814d86de99b8850

    • SHA1

      21bd6d19e5664158c3d4d77ca3a2b7889827d0d4

    • SHA256

      fd19e12aebfd870dcc7fe04359e6e7a53daeeb281c2dfc21f7740f8e65edd264

    • SHA512

      7c28b89d1e7c4c429cc2528cc935839be61a5cb41c621ae48547c7cc64479df6a0254382eaab2fba52af3d4cbf261ccffdfc8d0d40043042bc6cb86f7be7af1a

    • SSDEEP

      384:GSwPLqusAKYP/GKhwlJCXOxFm7bhCm/zH:xwz9HvK6XiFZKj

    Score
    10/10
    discoveryagentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Drops startup file

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks