Overview

overview

10

Static

static

5

Datasheet.pdf.exe

windows7-x64

10

Datasheet.pdf.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    29032025_0208_28032025_Datasheet.pdf.iso

  • Size

    1.3MB

  • Sample

    250329-ck246axp13

  • MD5

    1f46d050d9c9342da5a806ff95b51c87

  • SHA1

    0c23cc93bd67427ef5313464e5f3d651f8acf226

  • SHA256

    2edde6c7e98529244fcb35dc2b2f4bf4f3b99cbf886e337b4d72d53df6453ce1

  • SHA512

    32ccf8a5f39c9ec053cfab6c93ba62b65d095b060919e9f980a1b5390440585f00bfd5d4da0444c300d5881dd5a15f1b9d37ef40cf7fcca3c720e05cbc7a9952

  • SSDEEP

    24576:2u6J33O0c+JY5UZ+XC0kGso6Fax4H444tjQ8nYz3Jsnzvd2WY:Yu0c++OCvkGs9Fax4H444tjQ8nuJsbY

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      Datasheet.pdf.exe

    • Size

      1.2MB

    • MD5

      c18297b5b53a4847e696422d83d408d7

    • SHA1

      a1e8794a74797b2df257957107d7c36a73e1c52e

    • SHA256

      4a1b06e809dd5c48be6fe00d20a2117197159a21cc8cb5840fe64cd8b31661bd

    • SHA512

      46fba0e6efd1d654ded72a2086341e284f3880f258cf7fff079d744aafd15ca857538949fddc0e493c85f3e5d4eee8580fd7d8a4176316cb9eb47a0342392458

    • SSDEEP

      24576:Ju6J33O0c+JY5UZ+XC0kGso6Fax4H444tjQ8nYz3Jsnzvd2WY:ru0c++OCvkGs9Fax4H444tjQ8nuJsbY

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks