Overview

overview

10

Static

static

7

b8ba367e0e...de.exe

windows7-x64

10

b8ba367e0e...de.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b8ba367e0e847db97a2df73f6edb2b0c6656bf9d275f6ba6c0e3e8f1be1975de

  • Size

    689KB

  • Sample

    240428-bf3z8ace37

  • MD5

    1ada035e5d065c9f72c0edaede3d23fb

  • SHA1

    a078f140862da6ea430f4eb6090a674f1625c437

  • SHA256

    b8ba367e0e847db97a2df73f6edb2b0c6656bf9d275f6ba6c0e3e8f1be1975de

  • SHA512

    3fc582cb2d4989c62d3341afcdc197b179b65e845fd33c1321a88338d1c443c9f210f97e623062cb9ebe8eae7a65e4555f965407af545b15d2c625766b41e48d

  • SSDEEP

    12288:3YV6MorX7qzuC3QHO9FQVHPF51jgcdBQ+3TTuJ3sOi:EBXu9HGaVHd9i3s/

Score
10/10
agentteslakeyloggerspywarestealertrojanupx

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://inhanoi.net.vn
  • Port:
    21
  • Username:
    newboxoffice@inhanoi.net.vn
  • Password:
    ^TSt3!FK$UBA

Targets

    • Target

      b8ba367e0e847db97a2df73f6edb2b0c6656bf9d275f6ba6c0e3e8f1be1975de

    • Size

      689KB

    • MD5

      1ada035e5d065c9f72c0edaede3d23fb

    • SHA1

      a078f140862da6ea430f4eb6090a674f1625c437

    • SHA256

      b8ba367e0e847db97a2df73f6edb2b0c6656bf9d275f6ba6c0e3e8f1be1975de

    • SHA512

      3fc582cb2d4989c62d3341afcdc197b179b65e845fd33c1321a88338d1c443c9f210f97e623062cb9ebe8eae7a65e4555f965407af545b15d2c625766b41e48d

    • SSDEEP

      12288:3YV6MorX7qzuC3QHO9FQVHPF51jgcdBQ+3TTuJ3sOi:EBXu9HGaVHd9i3s/

    Score
    10/10
    agentteslakeyloggerspywarestealertrojanupx

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks