Overview

overview

10

Static

static

1

ELECTRONIC...df.exe

windows7-x64

7

ELECTRONIC...df.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4b0664b1b4c105adf0bb29ac14f18b6604af11cca83058eafbb22ae35f3ed271

  • Size

    1.1MB

  • Sample

    250111-bezleaymbr

  • MD5

    b263b9b184de3b1b0f1da899b81fccc4

  • SHA1

    48ddf98eba6ae1186d1aa7456f102b92aec59930

  • SHA256

    4b0664b1b4c105adf0bb29ac14f18b6604af11cca83058eafbb22ae35f3ed271

  • SHA512

    f5dd8ddf8d674b3e7edcc0bffc5ae5a946310edbacd31977f9409c186ac2af375b972793b5e81a05b6b4353e26bed5f86a4e5b6c832ab4d682ba5914885f907f

  • SSDEEP

    24576:bo5AicQMWlRG3wyZ/nvni5tSpItRXDspNamOVphLc9x0yWgvkl7TX52LOy+f/:bo5/lHyZ/vni1RT+Cdc9x0yWgvkl7TXX

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      ELECTRONICS_4600051054_20230327-pdf.exe

    • Size

      1.3MB

    • MD5

      615f4104278b0bb0e23b0349910374e5

    • SHA1

      896652569d4f66e7d7d59f49e44012c8c935506d

    • SHA256

      93a51ef6c14aa9b98e1408c7d52c9ad88ec1b6dc6f829ecbeb21db865f5fd222

    • SHA512

      1f67068f557371be3eb824c9f11123d6b67dd2530cc5166aaa8a276ea79e36189fa94f073fae9b46f37e13ce82a30578edfe6c0e34e271e743bc6f87dcd03902

    • SSDEEP

      24576:0gqg5IGA5kY8/b5haM0BC7Ch5VhJaFviYHBTi6FxjZulEL078cLs7yam1q9:LIGzZWM0QCnhJ4V9i6vjZ4HfYWaD9

    Score
    10/10
    discoveryagentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Drops startup file

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks