Overview

overview

10

Static

static

5

DHL AWB CO...LS.exe

windows7-x64

10

DHL AWB CO...LS.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe

  • Size

    1.1MB

  • Sample

    240701-l3dc7avfjb

  • MD5

    c519e1871f1521e167b56bad94b41114

  • SHA1

    bd504a951e281eb76b37de31613de084bcddeeeb

  • SHA256

    c89dbc33b2bed22fe68911bf6e23eb613cebc22f868290d4576822e26092798f

  • SHA512

    648ca2be6af1d37408b85764e504234942c657fa0d6c2791c08fcce35186ebf1e3b76e433701fed73f6bc5586d76d1584c49542e7e79bce17f13fc713dabf79e

  • SSDEEP

    24576:yAHnh+eWsN3skA4RV1Hom2KXMmHaUCmRC4Jer37G5:1h+ZkldoPK8YaU1A3g

Score
10/10
agentteslakeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe

    • Size

      1.1MB

    • MD5

      c519e1871f1521e167b56bad94b41114

    • SHA1

      bd504a951e281eb76b37de31613de084bcddeeeb

    • SHA256

      c89dbc33b2bed22fe68911bf6e23eb613cebc22f868290d4576822e26092798f

    • SHA512

      648ca2be6af1d37408b85764e504234942c657fa0d6c2791c08fcce35186ebf1e3b76e433701fed73f6bc5586d76d1584c49542e7e79bce17f13fc713dabf79e

    • SSDEEP

      24576:yAHnh+eWsN3skA4RV1Hom2KXMmHaUCmRC4Jer37G5:1h+ZkldoPK8YaU1A3g

    Score
    10/10
    agentteslakeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks