Overview

overview

10

Static

static

1

Purchase_O...2).exe

windows7-x64

7

Purchase_O...2).exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a2800485ad96ba86f2e87ace9d0e9f4c3f20304f7d24313f94b636185ce3c6d0

  • Size

    1.2MB

  • Sample

    250116-bw16kavjbx

  • MD5

    61cf3930bba195a84657543cd79555c0

  • SHA1

    9c68ea345122640a199b51df1d503df1ba43a674

  • SHA256

    a2800485ad96ba86f2e87ace9d0e9f4c3f20304f7d24313f94b636185ce3c6d0

  • SHA512

    25bbf267f919ddc750c76068936b42a714c0c7c6230480bf035cb2c28519f552ce1d7cb986d6e8925e1947f420e35d2818865e1710736bf6c7aedc602e701ec2

  • SSDEEP

    24576:avpU48LYXCmA5fO02IRKlnTzvgAGuaGnjhgRooPxpnv5sieuWBUqhq:14/Cm4fP2Mkzv19RjhMHxZReuWBy

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      Purchase_Order 276636.pdf (2).exe

    • Size

      1.5MB

    • MD5

      dc3af75561a56ac032e7a1e3070988ff

    • SHA1

      ade4df5684242436f7db4dc6c7542f3902886b4c

    • SHA256

      264b494687d3fff2f3b10816fa0133a40ee6a35b21e22206a0413364cfbd349b

    • SHA512

      db128d6744263ba6f82df8281398c7e9b740f5d50219befaa8790732a7c50f2bea5e4e25a962dd0c89c84e05485142b443436d724d20f4d8cd5023dc1a84ebc2

    • SSDEEP

      24576:C5xTK3fxsIFqUSE/GbkCh03Qf2i+8l0CNHefKOnci7/LUMfKJpS1qu:C5lQxsIsUSJb50AW8iCN+fKIHjLBcu

    Score
    10/10
    discoveryagentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Drops startup file

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks