Overview

overview

10

Static

static

1

Ref#12050776.exe

windows7-x64

7

Ref#12050776.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2f2143e8d986275d2d72e959094538cdbf99d1625e6ac1215c5981599ea67970

  • Size

    24KB

  • Sample

    250110-b4eyasxmdy

  • MD5

    5dbc5b91f996543b7cb6c5f8b25c9d1d

  • SHA1

    03516fcdfbb3bbf00294acc71db792f5eddd0f33

  • SHA256

    2f2143e8d986275d2d72e959094538cdbf99d1625e6ac1215c5981599ea67970

  • SHA512

    d65bee3325285f921af91c4151721bed0cd7bbd6e00de7ff21c518c29c09010f91afce02b571bd42fc22c17e3967d23c6b5b0045e41a43c8eed8c5684be5f4ac

  • SSDEEP

    768:xD6Jlo4U3SLrdlPUzS9IABrOteU+ShDFxVw5i7j:Elo6H2FmrOtqoP4iH

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      Ref#12050776.exe

    • Size

      110KB

    • MD5

      ed2d6030844e4c7bc6d904d559ee01ef

    • SHA1

      0636192747dfd9393defa391fee2f6191a28599a

    • SHA256

      d63768148b7d97c22b85af045f233e319eb533a1d8e3d3b7da5eb0280f3aa235

    • SHA512

      3cae6f4d756a5e9db0cb7a34b87a99ec6a3cbe12ddf01349bbde9fbee4d5af8b7d74f3f13a4df448b03cdd34531de727a2ab317f0f67122bd5ab62e5cde16399

    • SSDEEP

      768:Riq0SZkarbTS7TQwgKIUzA30d3xQs7hi16d2u4ugp4mF2zIV9XeS+ST6nkAv:IqpjbTSXgKIQiVgIe2uTBEiIC/m8

    Score
    10/10
    discoveryagentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Drops startup file

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks