Overview

overview

10

Static

static

3

PO - TY4892049.exe

windows7-x64

7

PO - TY4892049.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    29032025_0126_PO - TY4892049.COM.iso

  • Size

    1.6MB

  • Sample

    250329-btzvqav1ds

  • MD5

    7c34a8a5a6ef38191a944782b57867f8

  • SHA1

    a25bff8c8102529a75defbfb6ffa85eadfd5b97a

  • SHA256

    d269ead09be4b548ff43b9bff9a84c82f6548eae9fb42d6034d7aea715bac26d

  • SHA512

    4f7e7b7b4eb24d5db975797e87403a2a2937cca20885bfef4d829fc656c604b67d309f1b9d1546023b159d8134c4181f2f6753de2ca8aecb1fe5d29afebd3a0e

  • SSDEEP

    24576:+R+5zDSYjAWLkzYDhIzGz0+iIZBCIFmlbHO:/SYE+wGhd0gBB

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      PO - TY4892049.COM

    • Size

      1.1MB

    • MD5

      2e582c5427db5d6d22fa33507578b530

    • SHA1

      0eaac9c0e337fa0904b5c4a8c5d85ec36828aa7b

    • SHA256

      ebf55c50d9027e0944542c2be99a3c48eae6ca36891ab7a6c274e6a49c73576a

    • SHA512

      d5a21783534021f2642ee60118d6d2dfa9827375065f8e285652b0e81d0678dca2124b01088abd96fe762489a15a320466ff1f3736c593ba18db6587d26a75e8

    • SSDEEP

      24576:XR+5zDSYjAWLkzYDhIzGz0+iIZBCIFmlbHO:qSYE+wGhd0gBB

    Score
    10/10
    discoveryagentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Drops startup file

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks