Overview

overview

10

Static

static

3

New P.O. f...25.exe

windows7-x64

7

New P.O. f...25.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    New P.O. for W2025_1.7z

  • Size

    23KB

  • Sample

    250121-r6g4faynbt

  • MD5

    668c8cf2b6d221f3fb0e472c43c2e0ad

  • SHA1

    b66cb15e6f10848596c1e394880fd59d353963aa

  • SHA256

    6f0422e5a570762ba580fdad6e8d25e650190d859eda740bc5c4f454e91f5e26

  • SHA512

    2772720096bcc1323c1eee9d73a57d9aaaef9806a64092bf6d2d1b0502579d4385613ff0e454a4961e793beaad18c25beb0280c6971fd33c0887f2b8782a1fe5

  • SSDEEP

    384:uwq/KYwGYmp7zoMQIJ6EIoS+Nlwv7zMz2ffP29M2spHtC4mHXx4MYvjfESWi0:uwXUYY7zBQIJ6HoS+Nuzgz2f2i2spM4I

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      New P.O. for W2025.com

    • Size

      46KB

    • MD5

      d3c8de4b00030ddd7f5c9c6eb40f7e49

    • SHA1

      446acf91a2987bba28abc7839be81bf739a7112f

    • SHA256

      f6f3fe1f44d606a8c717d7ce911207c259a1f8844503e7513e99cc78a458d8cf

    • SHA512

      7a81499335703ee05d98584a5a7d5c15a535a6e329710779f1dc53b21ed48f13200dd51d8d77652254947c6bf2a9b89874815d02c47937172dba418400c3c8da

    • SSDEEP

      768:JMtp801KTj7nzeUwx5al8FO3+HLoRn73F/oP67+tSwHF2A:mtp801CrCjpFHHM1rFCzIwl3

    Score
    10/10
    discoveryagentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks