Overview

overview

10

Static

static

3

REQUEST FO...ON.exe

windows7-x64

7

REQUEST FO...ON.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6848283599fe858438853a577173ca0b13bf90687786566000fdb1c8a17ea701

  • Size

    1.1MB

  • Sample

    250110-b15pjszkfk

  • MD5

    abbe0aac83ecfd520c1d3c6c7c44bc74

  • SHA1

    4da88c19d1cb47af12b2a2e12519789dd12d4415

  • SHA256

    6848283599fe858438853a577173ca0b13bf90687786566000fdb1c8a17ea701

  • SHA512

    0109fa968a302aabb7965153f8ea174bb8b2c000ed16cdf3053acb135e968b083b855f21eeda19518c4fb7721c17ea90a5bc45b18e540f7a7536dd61a7cbba03

  • SSDEEP

    24576:z/FJZh2xJ1aXpu0SbqIWVSICaBakT9tpAErnBpM+z85/9uTZRiDe8EeLAdW:L6jao0S0bCaBakJb90+yuweNS

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      REQUEST FOR QUOTATION.exe

    • Size

      1.2MB

    • MD5

      0399527491e1f2bbbd72c1101b09b891

    • SHA1

      dae095c3f8374d8e8145be980931b4629d28d1bd

    • SHA256

      ee0ba8111f35e78e4e82d006349e9135ae802229f0b55d2db47c5a84b4aac3a0

    • SHA512

      0f1c761383f1bbdebbac85f2457bb1aaa0670712de7574992bd06b08964d73f444dde9f864635ce27346470dc7da77c63cf8997817cedbc568bccefa2ff2199c

    • SSDEEP

      24576:d+S+8kWaw7bdFCsh+LxD8evJtBofgMLJ+jKmlbCOAagkloC2F:d+SDT9YshMpooc+jKJNaxoC2F

    Score
    10/10
    discoveryagentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Drops startup file

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks