Overview

overview

10

Static

static

5

SHIP's PAR...cr.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SHIP's PARTICULARS CAPE ASTER.xlsx.scr.exe

  • Size

    1.1MB

  • Sample

    250403-emzg6ayxbx

  • MD5

    7a704292a8c7e4f5fc5a90c3a343887b

  • SHA1

    958d4af84968960603cb7f50b98dcfa3e9de805e

  • SHA256

    b5f5aed933ce7997aeec3e610e0fdeebcb5daf26a62ad73376f32e5aef9dbea9

  • SHA512

    47bcbb46d9096147770803043903bbcde779ed0df8bbcb34999c44ee4a1a5d911880ec742408b0de5838fbb9fa16d924093fa6295fb30831ec64cdba3110811b

  • SSDEEP

    24576:eu6J33O0c+JY5UZ+XC0kGso6FaRnW+qTTZtyC27NPdcfsIWY:wu0c++OCvkGs9FaRnW+qTNL6N02Y

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      SHIP's PARTICULARS CAPE ASTER.xlsx.scr.exe

    • Size

      1.1MB

    • MD5

      7a704292a8c7e4f5fc5a90c3a343887b

    • SHA1

      958d4af84968960603cb7f50b98dcfa3e9de805e

    • SHA256

      b5f5aed933ce7997aeec3e610e0fdeebcb5daf26a62ad73376f32e5aef9dbea9

    • SHA512

      47bcbb46d9096147770803043903bbcde779ed0df8bbcb34999c44ee4a1a5d911880ec742408b0de5838fbb9fa16d924093fa6295fb30831ec64cdba3110811b

    • SSDEEP

      24576:eu6J33O0c+JY5UZ+XC0kGso6FaRnW+qTTZtyC27NPdcfsIWY:wu0c++OCvkGs9FaRnW+qTNL6N02Y

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks