Overview

overview

10

Static

static

3

BL2716919550.PDF.exe

windows7-x64

10

BL2716919550.PDF.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    BL2716919550.PDF.exe

  • Size

    900KB

  • Sample

    230605-jv4jasfd99

  • MD5

    a8a10f16d378235bbee385cd47ae041b

  • SHA1

    2006595f2c0e2859eda8f344ab4b8cfc600e9b34

  • SHA256

    dfb099e4d381a076a936d5aa228763f7bf00e0c5fd80ced6437511a3101c33ca

  • SHA512

    aa7d4f42f8e904dd1d0547e5366edb1c5378f94bfb6ba53c7ef9efe4b77e5aec08c8a82c3579639f2eb79c482090bf284127de863de31d2acd0e2138865ae1dd

  • SSDEEP

    24576:SlI9BqmycgiH75BWt0gXNGVufX793cApE54tPsshnm:SW9Bqmycr7ysVKcX54Zs

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.tapiaamerica.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Censored12

Targets

    • Target

      BL2716919550.PDF.exe

    • Size

      900KB

    • MD5

      a8a10f16d378235bbee385cd47ae041b

    • SHA1

      2006595f2c0e2859eda8f344ab4b8cfc600e9b34

    • SHA256

      dfb099e4d381a076a936d5aa228763f7bf00e0c5fd80ced6437511a3101c33ca

    • SHA512

      aa7d4f42f8e904dd1d0547e5366edb1c5378f94bfb6ba53c7ef9efe4b77e5aec08c8a82c3579639f2eb79c482090bf284127de863de31d2acd0e2138865ae1dd

    • SSDEEP

      24576:SlI9BqmycgiH75BWt0gXNGVufX793cApE54tPsshnm:SW9Bqmycr7ysVKcX54Zs

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks