Overview

overview

10

Static

static

5

E-Notifica...7).exe

windows7-x64

10

E-Notifica...7).exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    E-Notification(Swift_Copy_000948736MTCB3827).zip

  • Size

    664KB

  • Sample

    250328-qlgrhaykv2

  • MD5

    38f19ce22038a09cdf87cbee300fcd5b

  • SHA1

    31770844ff5d86d5969b8ce12d1c413e3950877b

  • SHA256

    f2d10e5bbaa0e8c55dce360d2917f34eca5ffedc0c0b5b226e321bff7a581c2d

  • SHA512

    bb792a478ca4de207147eb79845320878cf7ea8c27b1776acfb7b586c3f99551c3430860626b2329a3c14bb2554bc6f031bff7ef626659780b43eebf112f5611

  • SSDEEP

    12288:SimaBuJojCRCRqvFx1WBluhKt3FQ/G+/WA2Lr7afW63rdFI5Tad5nB76tgU:ThuS+RCM7oBMhKpUWUTFwsar

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      E-Notification(Swift_Copy_000948736MTCB3827).exe

    • Size

      1.1MB

    • MD5

      41d58997e17d288cdf4733313e23e81c

    • SHA1

      285f17ba04fdbcca6f18f8b61e8c794aa4ccabae

    • SHA256

      63c0e81868b4d1d5744152cb95cbe7bdaaa4bc2670037276de94d80e5b0539c5

    • SHA512

      7e46c84f4a09862472efec7d030fced7e2f6be2a6b4d9f2363837f44db7bb67285e1b5951c8c8053d9aa73edf952c254ca5e1479ea46d6010290624972d84c5a

    • SSDEEP

      24576:3u6J33O0c+JY5UZ+XC0kGso6FaUiuxpZPFa2bG6WY:Ru0c++OCvkGs9FaUiufu2OY

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks