Overview

overview

10

Static

static

3

cacccbfd0c...1d.exe

windows7-x64

1

cacccbfd0c...1d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cacccbfd0c9975dbca0b686f166c1fac1a144cd379937ee1a0aa66183c83601d

  • Size

    884KB

  • Sample

    240429-bdcegsde47

  • MD5

    f75f9606f6aeb72bf28ecd1419542d7d

  • SHA1

    bc7eca6ece5ace34b990e8782dbe1782c33ea91b

  • SHA256

    cacccbfd0c9975dbca0b686f166c1fac1a144cd379937ee1a0aa66183c83601d

  • SHA512

    25cf388cbf234948055f5096010615745b92a6aea28328910dde72a13fdfc7f0a580f2e6b9b0544875a985da83f41a2fe04c7dd36eb687095a768ef31c1dd64f

  • SSDEEP

    24576:L0jj5VRQElW+B50gZuzTt/MDFdws7Sfn/eBGhW3:bElW+B53ZuPBaF2X7hW3

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.bestconstructltd.com
  • Port:
    587
  • Username:
    chris@bestconstructltd.com
  • Password:
    Cm54227290
  • Email To:
    winnie.lovetex@outlook.com

Targets

    • Target

      cacccbfd0c9975dbca0b686f166c1fac1a144cd379937ee1a0aa66183c83601d

    • Size

      884KB

    • MD5

      f75f9606f6aeb72bf28ecd1419542d7d

    • SHA1

      bc7eca6ece5ace34b990e8782dbe1782c33ea91b

    • SHA256

      cacccbfd0c9975dbca0b686f166c1fac1a144cd379937ee1a0aa66183c83601d

    • SHA512

      25cf388cbf234948055f5096010615745b92a6aea28328910dde72a13fdfc7f0a580f2e6b9b0544875a985da83f41a2fe04c7dd36eb687095a768ef31c1dd64f

    • SSDEEP

      24576:L0jj5VRQElW+B50gZuzTt/MDFdws7Sfn/eBGhW3:bElW+B53ZuPBaF2X7hW3

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks