Overview

overview

10

Static

static

3

eadfa6a10a...51.exe

windows7-x64

10

eadfa6a10a...51.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    eadfa6a10a2612b0f5f88565d71fd72bd8f6607651ba5440216296a29c478251.exe

  • Size

    183KB

  • Sample

    240629-caxfxs1fpk

  • MD5

    7561854de4a622de734380ecf24fad71

  • SHA1

    6e31c3bb371bd4a1530a6ec95ef94d4299ddaacb

  • SHA256

    eadfa6a10a2612b0f5f88565d71fd72bd8f6607651ba5440216296a29c478251

  • SHA512

    c6188d7ff81feb9356a8282d6a44dd015d8b2c1f52120d9fd823843400f28e7fc0cfde977f2e1174580dabfc43882d1d0c8e9ca817fe8400d95930f87f7f3b92

  • SSDEEP

    1536:oHYcrlkRPBxd9k+NXZA32xF5D1osgrvzsVxa:otrlKZ2R3QFx1osMvea

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot7121198832:AAHWmvzY7jDQqG8pk3uwnutesjvQDyHyYTs/

Targets

    • Target

      eadfa6a10a2612b0f5f88565d71fd72bd8f6607651ba5440216296a29c478251.exe

    • Size

      183KB

    • MD5

      7561854de4a622de734380ecf24fad71

    • SHA1

      6e31c3bb371bd4a1530a6ec95ef94d4299ddaacb

    • SHA256

      eadfa6a10a2612b0f5f88565d71fd72bd8f6607651ba5440216296a29c478251

    • SHA512

      c6188d7ff81feb9356a8282d6a44dd015d8b2c1f52120d9fd823843400f28e7fc0cfde977f2e1174580dabfc43882d1d0c8e9ca817fe8400d95930f87f7f3b92

    • SSDEEP

      1536:oHYcrlkRPBxd9k+NXZA32xF5D1osgrvzsVxa:otrlKZ2R3QFx1osMvea

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Detect packed .NET executables. Mostly AgentTeslaV4.

    • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

    • Detects executables referencing Windows vault credential objects. Observed in infostealers

    • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

    • Detects executables referencing many email and collaboration clients. Observed in information stealers

    • Detects executables referencing many file transfer clients. Observed in information stealers

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks