Overview

overview

10

Static

static

1

Holiday#3021.exe

windows7-x64

7

Holiday#3021.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1e7dab5f24be041ef518fd3d11b291e615b1383387e7c3bde6cb98faad087957

  • Size

    21KB

  • Sample

    250110-byjpaszjgp

  • MD5

    2ed7f228ae4d2b119d2115e56ea341d1

  • SHA1

    2a55ce3e2ae3e70bc4307729c9d3c3f3ed6cfb47

  • SHA256

    1e7dab5f24be041ef518fd3d11b291e615b1383387e7c3bde6cb98faad087957

  • SHA512

    134a36d41bb739bf24286be1172de85b6b0f44c476b8af806b41665e0b95146ea9fbf0d209213fd0120daabcfef49ccdf7ab12edbea99292ff7079a30fd9947b

  • SSDEEP

    384:g2YOjqCMLlX/GR0sPAn+hf7c46SKeFv5svUEFsC2QN/J+6Yl+q3:gnfCMZX/MtAYf7zxhcr8Q+hlZ

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      Holiday#3021.exe

    • Size

      103KB

    • MD5

      d94c4aad05654b76b8b2624808355886

    • SHA1

      f3c7911d8834836c22d78da8ae22e790ccd1429d

    • SHA256

      337d1f05a3bf83d7a42309f5155edaa070c4ba7219cec3346d98631af0cfb4a5

    • SHA512

      de80c7528d00e618a5071b93ccaf86cc697df6219f9e5adb4036aff163a9e87b88a461a8a36adecda1eebefd52d97630ac6d777c8c7a127759e2ea46938e0896

    • SSDEEP

      768:79tVmtzb9+Os5hidy/vn61YPkAbBfmFdEugpWWF2zIV9XeS+ST6nkAv:BtVH7DidIkVFdvD0iIC/m8

    Score
    10/10
    discoveryagentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Drops startup file

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks