Overview

overview

10

Static

static

3

Rwlleacvff.exe

windows7-x64

7

Rwlleacvff.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    29032025_0138_Order PO 202501164214.img.zip

  • Size

    1013KB

  • Sample

    250329-b2xqbsv1h1

  • MD5

    e2cdb327564f4c16093786927ecd88a2

  • SHA1

    b78a0aadd1e327dc76c0250b84ea43eacb776310

  • SHA256

    2e79a1944328468eeed0bbf560ec3dec59012afc623f33d56fa3a71b82806a2f

  • SHA512

    6d64f7a2ff78e892fdc9a352a165cb4df2e55e0462ef45b1948cc55da2bba454022b14aff0c8abd1fc7d9056ee270ee6068972aee74393487ea6150233a325aa

  • SSDEEP

    24576:kuYGswU5Ti8MEvdohSZDB9jFevu0nG8Mjpahs+RpVFPPm4ms5Mx4D:kuYGUu8MEth6uWzsapVVPmA84D

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      Rwlleacvff.exe

    • Size

      1.1MB

    • MD5

      d4b61b8225bba66d44e311d686014ecf

    • SHA1

      4df6fc35a76fa2bb71ad182a77881e8868b1d00b

    • SHA256

      ec52c66f567af3f66c74f28a63cd2c315646a34095efc933de90151ed7df9684

    • SHA512

      79f9c98d0c1e20290e274d6702bc3d4c617102097562b26a0d4f6101463ff501b7218d188ba45ada9cd5c776070084510ef17f7e72185f31f66155690f3b9d78

    • SSDEEP

      24576:6Uu7IVSXJ7gIYeEPdoh8/D39jFSNq0/7xMjp8xs+XpVHPpm4m8dL:6sNeEhVCq67LsOpVvpmY1

    Score
    10/10
    discoveryagentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks