Overview

overview

10

Static

static

3

PO For Quo...es.exe

windows7-x64

7

PO For Quo...es.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PO For Quote No 228 for lab Furnitures_1.7z

  • Size

    134KB

  • Sample

    250123-zh5tlasnas

  • MD5

    8c02a46d9820c4ef855cccff4a5a2cf2

  • SHA1

    e245541232fee49bcce09e2cbc5dbcf20b03d538

  • SHA256

    90f0da77b0cba290f46715165e81abeae84f374f0aa07fa4b0ab4279687e28ee

  • SHA512

    0f7ad17fc1d2b30b4bd2078491bc8e12faaf8a77bd358f233347f8daff31a3141c4db9c64d9a77193f19a2153a52fc287875b4d9522b7076144b7b56e982eefa

  • SSDEEP

    3072:Bc+juC++s06xbEC7ltSCOdqumVDo5IxkgERDNfsmdK5USGXUM6LuJS/AWH3fE:Bcu+W6hE6SCaqu/ckgEhhN0UHUfL6adM

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      PO For Quote No 228 for lab Furnitures.com

    • Size

      396KB

    • MD5

      c74ffae162c3a8af2dcd2d2f4d0fede0

    • SHA1

      6996ba2de525eaf627a8b4f78a7c7371d29e3b1b

    • SHA256

      b2059d59922556f2677361a44d5b1c0a4422654e1f8e1af8f311771c4cf818d2

    • SHA512

      9be2b36a97579bd569957dd4812419aca7c57eb2e61b3cc29cd6bb77a5cd158fd9ad11eb9dfe89a0e07be1ad45adf626133c37d100e11d72e1c9b5aaaa31e47b

    • SSDEEP

      6144:5la+LP1qv+e6otZg9EtEkh6hQSwBlagbZU:Xa+L8nVjtEMbSw8

    Score
    10/10
    discoveryagentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks