Overview

overview

10

Static

static

5

PAYMENT-IN...01.exe

windows7-x64

10

PAYMENT-IN...01.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    22012025_0006_21012025_PO No.4500491839.7z

  • Size

    978KB

  • Sample

    250122-adw88aylcj

  • MD5

    525c8f9d5ebdf8f38d60a474bf8d5450

  • SHA1

    9a17be53ca4905a60e7ce47c91801fff59928c9c

  • SHA256

    bce0ac94f5fb59ead6808a018e8e11044af82ae55e39e14580c18fca65eff04a

  • SHA512

    5102ef89dd136f5e5c10559333d464e5ac146a9403cfd863d5cdbba1b7a52815b04312c85fce7081aa9beab6d9edce698d8072ff5e1d49b466d0c56225ce71d4

  • SSDEEP

    24576:PFEoKs5hRr/mBSVnTRcXz2ftv6jT+FMWmM/Pq:dzbR/mBOij2ftvoKFMvz

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      PAYMENT-INVOICE20252101.exe

    • Size

      1.4MB

    • MD5

      82d536a65d5474261f4bec0cf590574b

    • SHA1

      dec3ab4eb0d1a82889000f57e172948ad4fe2d1f

    • SHA256

      15e55a1c746933955d19246f4f8629d22c086f3eed47c7e0fa470d57498d5cd5

    • SHA512

      ac9407d365d2da598f0ee65f58becb0426d566dd6546b24f72d7ecf662dd8285448e8365253aa7c74dcf08ceb938170941d5741afeacff71272f07b5304e20ea

    • SSDEEP

      24576:6tb20pkaCqT5TBWgNQ7aXJYUPn7RAuz2qtvIjb+FQWnMTq6A:nVg5tQ7aXJY0q42qtvOCFQkV5

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks