Overview

overview

10

Static

static

3

PR No.exe

windows7-x64

10

PR No.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_60f1189baa8a9b831473b081bd0443ee

  • Size

    745KB

  • Sample

    250101-14gjkazkem

  • MD5

    60f1189baa8a9b831473b081bd0443ee

  • SHA1

    12a2a363a7401abc8134fb80e47c46c73afe0841

  • SHA256

    7ed69736cbb15764df71af5ee264436d4ebc045ebda7a52d5652c9c59cdb4977

  • SHA512

    4edd2a6e73a24c0ee7a49336af751c9a57b5241b0cde5cdee3e85e0e65884234ce90e24b8c44c062db7c4e7aecdf608bbc9240579f0124a7f89c0a396f8f2d8b

  • SSDEEP

    12288:/F6miCjz27TvVnOkX+o+ZKZY6JvAn4oa/Rnvfogl5HMwKK3EOis5e+pXaNZ2DT9s:d6miX79O4kZeZun47xvwUF3EUebNZsa9

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      PR No. 23578

    • Size

      645KB

    • MD5

      68ca08a7737f16fe5ab37362f6ec232f

    • SHA1

      96c9ee0c843884c909ce8616ffca0f7ccc0dfac7

    • SHA256

      bdbc9d209782fad292f3f2dc54e8e3495e9acfd6d24d8263b584240b6630f2c3

    • SHA512

      a336a66a18fab9bd231789f8d4bee79c6c78fc4ea3a54d8d573f14149db91e8993d60b32d04e35950c96554c1e88178317cb724823b1ec6ef1dbea890db75ade

    • SSDEEP

      12288:0oOi8IzGNhvHoCLs0Amm52qO4caxecLP2uhs5A1LkUv0:w/vL3AmRaxecLOu51Lvv

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • AgentTesla payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks