Overview

overview

10

Static

static

3

MOA/MOA. PDF.exe

windows7-x64

10

MOA/MOA. PDF.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    14bb57a9b3fff927afb651692bc1bc08689844e814b762c1053f1b6258646e3b

  • Size

    172KB

  • Sample

    250303-enrhyawqz3

  • MD5

    ebc01261067df55b98c939a9530490ff

  • SHA1

    6abe29840c4e523a80055c49c55eee1565ee3c8e

  • SHA256

    14bb57a9b3fff927afb651692bc1bc08689844e814b762c1053f1b6258646e3b

  • SHA512

    0e3fcf323e43985483cef298c73343dda37abfdbdfd04a8996733bcbdb365a74d8d72f632add908320f710b0b5452c36c5c1ab4752e7a38f1111b232e5db9633

  • SSDEEP

    3072:FRLoxBp8JF3YTTJRnCeXtgnQbC5mfIBoQx8p/O:zs4F3YTXrtgnEC5/

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      MOA/MOA. PDF.exe

    • Size

      183KB

    • MD5

      187f9b4f334d0ad137204023daa66166

    • SHA1

      680caa77164fee22b2003f5d81174f66e7946399

    • SHA256

      0a13ea4fa8382c49dc0ace6bda604ea41e8f5fe78a2691bf7c808c7b88efbfb1

    • SHA512

      bb43d42eb283dae5e170f4e550e210935e862e7f4b4a459c5fe494fb748936635327b4f77960e051f76b8bda2106f9c2d17b9c80b0bcd2ecc0828954d039ec37

    • SSDEEP

      3072:rpjojTLKfzu9ap8JF3YTT5RnCeHtgnQbC5MfIBoQx88SzZ87tG1:FgLKfy9a4F3YTfjtgnEC5n

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks