Overview

overview

10

Static

static

3

PO. WW.exe

windows7-x64

7

PO. WW.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8cfd80896c3a9d44bbcc0ef7a91d7ab0fdc6906496e60e8bf7cddf7fae069923

  • Size

    1.1MB

  • Sample

    250109-bwtrgsvlej

  • MD5

    c8f8b0db2e80768bfb6f5e6f98bda35b

  • SHA1

    2b49c6abd97c23fa438d70e0b0d1079860f6960c

  • SHA256

    8cfd80896c3a9d44bbcc0ef7a91d7ab0fdc6906496e60e8bf7cddf7fae069923

  • SHA512

    39135ba3ae919ea965a62c7cbb8cf618dd3be4ed9bc87d23a66711b6f3b72a594c07230fbe2c0087bff5a1e28dc1055b233dd39b45871a1410a54ccfc938292f

  • SSDEEP

    24576:oM1+HNrjD9sg6Q8u9IVG1hcI3poYaNQ6yNoGLwdde17olA2:X1+X2g6pu9J8KoYaNLyNcdo7c

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      PO. WW.exe

    • Size

      1.2MB

    • MD5

      115e174187d5433a053e4df3946d688b

    • SHA1

      ea4a06de4a04475729b45326f67ff72a630c2fbe

    • SHA256

      6934ac3b946dab8001c3f64f506052e846197065497b16cabbb6163d4261e98c

    • SHA512

      c030bd3fefacb411d3bba0b4820a06d1b78b2f11c7b276d3079495e046309ecfd62cf55154cf9cb54b82de51fc91dd7b61b580117ed23cc676c42cd1c5e71634

    • SSDEEP

      24576:XtNybsvU8Ivf2xcyqYuvfwq05jZMlDGgK7B6YuWRWmR2JPAMZ20FF:fybJ6huvfl05jZytK9FzcqMZLFF

    Score
    10/10
    discoveryagentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Drops startup file

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks