Overview

overview

10

Static

static

3

71cb5530f6...f2.exe

windows7-x64

10

71cb5530f6...f2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    71cb5530f635f1229d43e4fe9c5bbdb04cf9053832fa006750690854a883eff2

  • Size

    1.9MB

  • Sample

    240701-bkyw3a1gnf

  • MD5

    85a68d401bbb5751b02fb9ca159b6eff

  • SHA1

    99b6b9e728ebc315a2ae04505de04b0f922f7cd1

  • SHA256

    71cb5530f635f1229d43e4fe9c5bbdb04cf9053832fa006750690854a883eff2

  • SHA512

    0f83dc75c47794dcaea3e8ec00f472e2b9281ece33031c9894671522f25489a446bc9c1ecc980a8ca262a7cb6cb5c3d43d22cf692a2094ec01410bca44b718df

  • SSDEEP

    49152:bOD+bTI6YTDml4HJPHDQkOBU0f9iygcrxZ3aU5Z/IrRo2ht1a1nvkJzJ:Sv85QzJ

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      71cb5530f635f1229d43e4fe9c5bbdb04cf9053832fa006750690854a883eff2

    • Size

      1.9MB

    • MD5

      85a68d401bbb5751b02fb9ca159b6eff

    • SHA1

      99b6b9e728ebc315a2ae04505de04b0f922f7cd1

    • SHA256

      71cb5530f635f1229d43e4fe9c5bbdb04cf9053832fa006750690854a883eff2

    • SHA512

      0f83dc75c47794dcaea3e8ec00f472e2b9281ece33031c9894671522f25489a446bc9c1ecc980a8ca262a7cb6cb5c3d43d22cf692a2094ec01410bca44b718df

    • SSDEEP

      49152:bOD+bTI6YTDml4HJPHDQkOBU0f9iygcrxZ3aU5Z/IrRo2ht1a1nvkJzJ:Sv85QzJ

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks