Overview

overview

10

Static

static

5

5950e33fab...30.exe

windows7-x64

10

5950e33fab...30.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5950e33fab29f509b5c4c54b4313bcca5cf8e1d893bcddb638d7c32a6d5a7330

  • Size

    1.0MB

  • Sample

    240702-bf23xsvbjl

  • MD5

    2ecf9df7d8c1a0a2243495f62549ae4e

  • SHA1

    798292e933ea1c0e3bf39bc853f6c094462a0cf7

  • SHA256

    5950e33fab29f509b5c4c54b4313bcca5cf8e1d893bcddb638d7c32a6d5a7330

  • SHA512

    8b589c7768759190a15b440ed29095bfa33d69c9a9ae5774669fd0433b4dc59f26c7f0bb891c9f7bdea996445d0bd0cd4f318cdeb6be28fc487ef467bfa8b782

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1Hom2KXMmHaEsffEo8W2Vu5:Rh+ZkldoPK8YaEy8W2G

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      5950e33fab29f509b5c4c54b4313bcca5cf8e1d893bcddb638d7c32a6d5a7330

    • Size

      1.0MB

    • MD5

      2ecf9df7d8c1a0a2243495f62549ae4e

    • SHA1

      798292e933ea1c0e3bf39bc853f6c094462a0cf7

    • SHA256

      5950e33fab29f509b5c4c54b4313bcca5cf8e1d893bcddb638d7c32a6d5a7330

    • SHA512

      8b589c7768759190a15b440ed29095bfa33d69c9a9ae5774669fd0433b4dc59f26c7f0bb891c9f7bdea996445d0bd0cd4f318cdeb6be28fc487ef467bfa8b782

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1Hom2KXMmHaEsffEo8W2Vu5:Rh+ZkldoPK8YaEy8W2G

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks