Overview

overview

10

Static

static

3

DHL - OVER...28.exe

windows7-x64

7

DHL - OVER...28.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c98967c8c1f94b63ef7ab0854ffe49abb4f7dc5ac0619346fd628d57d94cce53.tar

  • Size

    1.1MB

  • Sample

    250227-evdweswls4

  • MD5

    c34df3db3ced4cc77de9e65c76bb68a3

  • SHA1

    5a74e9bbab9a07a84d855d87cde84f4b6dd39e39

  • SHA256

    c98967c8c1f94b63ef7ab0854ffe49abb4f7dc5ac0619346fd628d57d94cce53

  • SHA512

    f707dcfa71021b560b348f0602c11418df3c812ab21697bf0590a031454f76ca3d4285798dea4e5d0bd06f9045f85b5638b144219751b8b214e4ec38b15f5ef0

  • SSDEEP

    24576:x9diHWuYeyoQlSKsh2aCGGoEiFN38cyc4vITabo:x9diHfYez3hG0NKHrbo

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      DHL - OVERDUE - ACCOUNT LETTER -1300711528.exe

    • Size

      1.1MB

    • MD5

      bc156f46d50fdebb471a0a3daf71ead0

    • SHA1

      bc1ab193c169b194af205a3215da6385f2e0dc0b

    • SHA256

      372ef724cb2ba60abccfa7f0ac12e571059a3b28620a54a97a163a9b5a7205f8

    • SHA512

      f6a8b48ab987bf0f25e8747361a309566a40b3b6f1afbf6e459099efd48dd673603941c66025924aeda64ec95f6b093c941fd75719310328ca691e2682849d48

    • SSDEEP

      24576:L9diHWuYeyoQlSKsh2aCGGoEiFN38cyc4vITabo:L9diHfYez3hG0NKHrbo

    Score
    10/10
    discoveryagentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Drops startup file

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks