Overview

overview

10

Static

static

1

Ref#120795203.exe

windows7-x64

7

Ref#120795203.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f3d1d1b145208ee2e06e57f2509c08527ea01c671ffdb9b335d5da086e41d836

  • Size

    21KB

  • Sample

    250111-b1992azmdm

  • MD5

    23af822d49d721ca185a82e3741971c5

  • SHA1

    37bbf36cb02f8079fabaa1233ee5028d33f1e8b2

  • SHA256

    f3d1d1b145208ee2e06e57f2509c08527ea01c671ffdb9b335d5da086e41d836

  • SHA512

    a7bd9590cb2fc142f639c442784b34710501bae007453f887e138b131c4547645286b6b282af56bfed7e4613413f0698a4e983fd349b534adbcb961b35d867c9

  • SSDEEP

    384:OuR5U6iBw9PvoMMykkd98f6hXz0bUFquPU+VZG3B17SyavDVQPfmiN6XesGbajqu:OO5U7uD/krkz0b+1c+VZwDLTPfmiNDvu

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      Ref#120795203.exe

    • Size

      103KB

    • MD5

      be6afce715f261658914e050e2b3919c

    • SHA1

      137d53925366a03cc0d81d2195c82fd023c4006a

    • SHA256

      7cd4fb83f485524e6a176ec1d6d9a5a21e2cda287050c4ecee6e47e6a3b35911

    • SHA512

      104addf8ddcae2b9ee6ade0d15185ff967530df51e1e86b04d40e5286d79a532cba2e1da8287a5938a54c3f12518a442e9faecb1adfbe0f1d4b4338bac46b63f

    • SSDEEP

      768:O9tVmtzb9+Kn2Kf9HRTyovn612PPk/DBfmHd7ugpYsF2zIV9XeS+ST6nkAv:CtVHKpHRT9kgHdShWiIC/m8

    Score
    10/10
    discoveryagentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Drops startup file

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks