Overview

overview

10

Static

static

3

PO.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PO.exe

  • Size

    1.4MB

  • Sample

    250402-pn2c9ayrs9

  • MD5

    ab51b833c511b090e286527580db32e8

  • SHA1

    48a0b39900158e0f5fbd804603244fd07df28d83

  • SHA256

    a017ebe5d908a488c9fe0e16c08d8dece7eeb761eae0f29a873ede41a751bccb

  • SHA512

    69d7a5717c83f5ffd55a104e8ce1253a7d724b4bde882b17f47eb100a8f5147eb1142d180e972df509927dffdd2c048e550ec656ed52e5dfd303309b9d2b25b1

  • SSDEEP

    24576:+RRHGVP2hQ9ytwN5iaJ8A4WGT9Hq8ziqBmpU4RHakm2IpBT:+RAIMh8ZjRq8Gq0pU41aT2InT

Score
10/10
agenttesladiscoverykeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      PO.exe

    • Size

      1.4MB

    • MD5

      ab51b833c511b090e286527580db32e8

    • SHA1

      48a0b39900158e0f5fbd804603244fd07df28d83

    • SHA256

      a017ebe5d908a488c9fe0e16c08d8dece7eeb761eae0f29a873ede41a751bccb

    • SHA512

      69d7a5717c83f5ffd55a104e8ce1253a7d724b4bde882b17f47eb100a8f5147eb1142d180e972df509927dffdd2c048e550ec656ed52e5dfd303309b9d2b25b1

    • SSDEEP

      24576:+RRHGVP2hQ9ytwN5iaJ8A4WGT9Hq8ziqBmpU4RHakm2IpBT:+RAIMh8ZjRq8Gq0pU41aT2InT

    Score
    10/10
    agenttesladiscoverykeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks