Overview

overview

10

Static

static

3

new order ...79.exe

windows7-x64

7

new order ...79.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    new order 4504333579_1.zip

  • Size

    30KB

  • Sample

    250113-qqnevawkgk

  • MD5

    eb127200d9f227affb6bf46bd3950306

  • SHA1

    6d6afbd2ef43d770742b0ee5fbe44c17ef589c05

  • SHA256

    c22e1fcf871af7ca2d0906e6c0f15a0043a5a263475ae4beddf0a8984871a754

  • SHA512

    499ebb90b099bf9f7cf2552e2c69874b6537b94aa84ec18b2eb57bd54874ade2e5cf50259314ef6318bed1401a126f36a9d2cd6613de140aebec4261be8611a0

  • SSDEEP

    768:YQJqo86Asq6cLdMEuptBZd4GF2x6xKzpzEICLTZNFefc0yRofYdj:Y0qoRY7updez6wlEICffFefEyYj

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      new order 4504333579.com

    • Size

      67KB

    • MD5

      36ae28620e7244b3a156dba6ff89a8f0

    • SHA1

      bb31a9865a529075e7ec0addfa96e5f71e2049a0

    • SHA256

      27176b90fbe01af0c55c519bf0132245b8102cee3eed98d2ff8bc259e0313142

    • SHA512

      6c6abb7bc0db8ff6b9011b2c1e508fd55c03784c16ba5cc929738f39833ff506d9fc6b56f7f13199d017dc04d9c164275304e1b3910c70dbf95caf3b2ecf8f46

    • SSDEEP

      1536:nv7a6wXjugRKE5xgVxTJAXoEROZPmAo2+P9KqWITSdn:voTBME58xTCXjROZPmA/WKjI6n

    Score
    10/10
    discoveryagentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks