Overview

overview

10

Static

static

3

OVERDUE AC...ER.exe

windows7-x64

7

OVERDUE AC...ER.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    OVERDUE ACCOUNT LETTER- FINAL REMINDER.tar.001.tar

  • Size

    1.2MB

  • Sample

    250328-qlhc2awwhx

  • MD5

    eae854255f3d8184d94fe1eb6c93e55b

  • SHA1

    ebfe8490c5a57d21e05c46f4d2562473b9c3f4ed

  • SHA256

    c435512ffeb6eff6d961ed5689e5626bccf624cfdfb5b6b92658bb3af2413ebc

  • SHA512

    1e16cdecb76212ffd32923424ac4c18f158fbaca3ef51d605190d690bc02c3a607cf2cda71b0504270818e610b724f8e1e7d5a8aa84a29aca83b0740e5f01667

  • SSDEEP

    24576:WB/p8ViCks35dyU5AjCAVCyCShbwlvsl4de9V:WBxnqAjzHhbeb+V

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      OVERDUE ACCOUNT LETTER- FINAL REMINDER.exe

    • Size

      1.2MB

    • MD5

      b3e91c314a64d5e8ddd4ca2110da055b

    • SHA1

      1874ea6cc675b80ddcba84ffffa7eb7a0e4cea0c

    • SHA256

      bbadbf3fdbbf1e1d3b0990bbd18ab566cc3028538d4fab8981d0f8505d44349a

    • SHA512

      33febd63084d66ef0d7a9fd969057519d7ab7c75411729354e182a835ba080d77c1909a7231ba98abf83bae99ee6f46407ab8f92ab70165b0f620d6acac4519f

    • SSDEEP

      24576:LB/p8ViCks35dyU5AjCAVCyCShbwlvsl4de9V:LBxnqAjzHhbeb+V

    Score
    10/10
    discoveryagentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Drops startup file

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks