Overview

overview

10

Static

static

3

f209837bef...0b.exe

windows7-x64

8

f209837bef...0b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f209837beffa4be11333eff1bbc6d8850819bca5765ed8807157907cba99a40b

  • Size

    671KB

  • Sample

    240702-bfy19s1brc

  • MD5

    fc49d6f8df9022fb326d9b10ddec31c7

  • SHA1

    f0539acaaf8b1ea9204cac3dab7f6aa2c30b567f

  • SHA256

    f209837beffa4be11333eff1bbc6d8850819bca5765ed8807157907cba99a40b

  • SHA512

    a173ff00f588f78c22fcbe705e3fa9962c8f62ca08d46707fc3e2a2d14addd3c3455331fc61a288f5a6e73611eea5346ac4c237397982c483dc5ec962f3a3213

  • SSDEEP

    12288:z/ktlwUVjRG6arSqZq/2ahHA1iXBcjYQwNBl13+sin701wgJbP7jmq:zIE6a+t/2hI5Un701wgJTJ

Score
10/10
agentteslaexecutionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      f209837beffa4be11333eff1bbc6d8850819bca5765ed8807157907cba99a40b

    • Size

      671KB

    • MD5

      fc49d6f8df9022fb326d9b10ddec31c7

    • SHA1

      f0539acaaf8b1ea9204cac3dab7f6aa2c30b567f

    • SHA256

      f209837beffa4be11333eff1bbc6d8850819bca5765ed8807157907cba99a40b

    • SHA512

      a173ff00f588f78c22fcbe705e3fa9962c8f62ca08d46707fc3e2a2d14addd3c3455331fc61a288f5a6e73611eea5346ac4c237397982c483dc5ec962f3a3213

    • SSDEEP

      12288:z/ktlwUVjRG6arSqZq/2ahHA1iXBcjYQwNBl13+sin701wgJbP7jmq:zIE6a+t/2hI5Un701wgJTJ

    Score
    10/10
    executionagentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks