Overview

overview

10

Static

static

5

bnn.exe

windows7-x64

10

bnn.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bnn.exe

  • Size

    1.1MB

  • Sample

    240120-sbmacabgfm

  • MD5

    a75a9fe738f5b6b2b34daf99fef72cf5

  • SHA1

    4e93be3a205b7c085efb0b79fd92103bf4dce15f

  • SHA256

    370e02c2619bd47c427f97881eafc89167f58084e9f41c9d9edc81318180d405

  • SHA512

    c118daa3f26e08464333a3f0db9fda9fd7d31df854e3a1e032e4da1b70e5e113fb2de96ddc7c6b5ecdb96cd52d7cccfcdeec7f79de9c71f36c76378a322804a3

  • SSDEEP

    24576:9qDEvCTbMWu7rQYlBQcBiT6rprG8aZCsPgMrg:9TvC/MTQYxsWR7aZCs

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot6036191007:AAG666CvGTNytMyFGIeVwbtc7GwGgBSmgOE/

Targets

    • Target

      bnn.exe

    • Size

      1.1MB

    • MD5

      a75a9fe738f5b6b2b34daf99fef72cf5

    • SHA1

      4e93be3a205b7c085efb0b79fd92103bf4dce15f

    • SHA256

      370e02c2619bd47c427f97881eafc89167f58084e9f41c9d9edc81318180d405

    • SHA512

      c118daa3f26e08464333a3f0db9fda9fd7d31df854e3a1e032e4da1b70e5e113fb2de96ddc7c6b5ecdb96cd52d7cccfcdeec7f79de9c71f36c76378a322804a3

    • SSDEEP

      24576:9qDEvCTbMWu7rQYlBQcBiT6rprG8aZCsPgMrg:9TvC/MTQYxsWR7aZCs

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks