Overview

overview

10

Static

static

3

Potwierdze...oc.exe

windows7-x64

10

Potwierdze...oc.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Potwierdzenie zamówienia.doc.exe

  • Size

    768KB

  • Sample

    240701-l2s29aycnq

  • MD5

    0b2cc11236f4f6cd2ead26a1d02c7a60

  • SHA1

    1a9f29f7478792d01bc11bc2cb7c1c9aa2dc4576

  • SHA256

    be68709a0e66e6137a003d1dd97dae958cf10ab2cff49d66b8aabcf4b618b9b5

  • SHA512

    52ea86584a1817c1a435358a8b3f55e0987dbe7bf43cd8bbf1afcd1a59dc4d42340cfebd71d1510d1f4535065acf123e8a06d4063aa2eda2be6ae5991782ea02

  • SSDEEP

    12288:RKcuUYs8wcu0MyQYtM1l6ogb7jahORQUiLcXW3XJ64DGzZBueipqDKM1o33:QcdYsdcX3QwSlsbahCEcXWZ64mZBWM1+

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      Potwierdzenie zamówienia.doc.exe

    • Size

      768KB

    • MD5

      0b2cc11236f4f6cd2ead26a1d02c7a60

    • SHA1

      1a9f29f7478792d01bc11bc2cb7c1c9aa2dc4576

    • SHA256

      be68709a0e66e6137a003d1dd97dae958cf10ab2cff49d66b8aabcf4b618b9b5

    • SHA512

      52ea86584a1817c1a435358a8b3f55e0987dbe7bf43cd8bbf1afcd1a59dc4d42340cfebd71d1510d1f4535065acf123e8a06d4063aa2eda2be6ae5991782ea02

    • SSDEEP

      12288:RKcuUYs8wcu0MyQYtM1l6ogb7jahORQUiLcXW3XJ64DGzZBueipqDKM1o33:QcdYsdcX3QwSlsbahCEcXWZ64mZBWM1+

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks