Overview

overview

10

Static

static

1

Bank confirmation.exe

windows7-x64

7

Bank confirmation.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bd450e78d6728b25a9d9695cc0060b478b32658db92e67e16205ae91c205113e

  • Size

    1.1MB

  • Sample

    250122-bx249a1rdq

  • MD5

    39b95c08be44c5f616593e03cea3653d

  • SHA1

    827a077936501268544d5bcf627321c064c594ec

  • SHA256

    bd450e78d6728b25a9d9695cc0060b478b32658db92e67e16205ae91c205113e

  • SHA512

    a3af3883870802ce882c52391ddcb11e6c91ada79fa17d58d04eeab43bb42086557796f84e8c9ecbdf002073cc70abefa7c0d41b012e4bd885d6685355fbf1f0

  • SSDEEP

    24576:UuRx/z6eNdFdacYDIYGgXNZV7uRvDkq8QZlVGOTshFzp5c:UGNLdxaNryvDkCZlVGvnzp5c

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      Bank confirmation.exe

    • Size

      1.3MB

    • MD5

      4b9ef15314017fc83c7eea21dd5607b4

    • SHA1

      997669512734756fe74554f0c1accd9d10e78865

    • SHA256

      7d1433cbe3f549a132b60579236df74b7eb641aabc249927a7621881f74694db

    • SHA512

      b062e3ede40853dbe476ef31dfc9c882e2e4ba6119a727218204ce103b2a7d4d38dc0d57338825420553f1561063333e5923e9c53176b92c456fb30e1e3b1a14

    • SSDEEP

      24576:H4789o3zfA8fWQNmpC0M8IV/Fl4bwUKzaMw9R1MF0HftEnF4f61qj:tO37fWQNmFIV/FNAXU1OfXj

    Score
    10/10
    discoveryagentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Drops startup file

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks