Overview

overview

10

Static

static

1

009.vbe

windows7-x64

8

009.vbe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e82da29ba80ba9f702db759c4ffb8e755db261421f74a222f9bdb7822999c24c.rar

  • Size

    4KB

  • Sample

    250115-eb8xfszlfw

  • MD5

    4cccb36dad6c1dcea35c7eb9403ae164

  • SHA1

    e162ce31a8027830890ddf51d45f7da45f564ea0

  • SHA256

    e82da29ba80ba9f702db759c4ffb8e755db261421f74a222f9bdb7822999c24c

  • SHA512

    a86a211862228ebbc8841674b851f8e6428df7798e82512878584b9a85d89b222d68671b6b19343574570f2eb3e01a28e3b1a2f9bdb50b9ec87cadf79149efcf

  • SSDEEP

    96:S3MHeRYGMHmOJOZbhLQLC/vaOLL6qQyLmFWF:S3M+R/MHmaiMW/vR3VQyLDF

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      009.vbe

    • Size

      10KB

    • MD5

      9ff77002fbcbdd6e749722541b423034

    • SHA1

      ea5ff219e2dde3cc57a1668ff0526be5b84e1250

    • SHA256

      5b3b169b48056c1cd8b84093c312de2f9ec1c7a1edcd7591743f6eac62c98ab9

    • SHA512

      609f25739f34355e0e37fd244cd743f3442be6cb2518ff9fa0ec58ec5ec103e730d5f005ca86c040a7b3a078d49dd6b2363659085eaecc2de2fd24159da13388

    • SSDEEP

      192:meHNd/sigyXaoMutGV+GCCYSyC+QvdyNhnKxtKlK:5HMiTDV+xnYSH+QVyNhnctKM

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks