Overview

overview

10

Static

static

5

Datasheet.pdf.exe

windows7-x64

10

Datasheet.pdf.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    29032025_0132_Datasheet.pdf.exe.iso

  • Size

    1.3MB

  • Sample

    250329-bx5v5sxmy6

  • MD5

    b917f814fbba349a57b7b8f3fbf6ff3f

  • SHA1

    c2cf0071f0735b0563a29c6fb3703edad2266d26

  • SHA256

    9cd3c3cc996a883d7e920b274df67ae39a840a63775decd8622c4de78f1d5254

  • SHA512

    cdb189fe60470cd0f13d06418c0b265762dacd2bdb37c81792d709b073324d3acce682bdbe149be382ae243fff88e8bd507680b8458677e1a898e9dfb1d1989d

  • SSDEEP

    24576:2u6J33O0c+JY5UZ+XC0kGso6Fax4H444tjQ8nYz3Jsnzvd2WY:Yu0c++OCvkGs9Fax4H444tjQ8nuJsbY

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      Datasheet.pdf.exe

    • Size

      1.2MB

    • MD5

      c18297b5b53a4847e696422d83d408d7

    • SHA1

      a1e8794a74797b2df257957107d7c36a73e1c52e

    • SHA256

      4a1b06e809dd5c48be6fe00d20a2117197159a21cc8cb5840fe64cd8b31661bd

    • SHA512

      46fba0e6efd1d654ded72a2086341e284f3880f258cf7fff079d744aafd15ca857538949fddc0e493c85f3e5d4eee8580fd7d8a4176316cb9eb47a0342392458

    • SSDEEP

      24576:Ju6J33O0c+JY5UZ+XC0kGso6Fax4H444tjQ8nYz3Jsnzvd2WY:ru0c++OCvkGs9Fax4H444tjQ8nuJsbY

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks