Overview

overview

10

Static

static

1

orden de c...la.xls

windows7-x64

10

orden de c...la.xls

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    orden de compra.xla.xlsx

  • Size

    391KB

  • Sample

    231207-va3baadf63

  • MD5

    060f999d180fb2c37059815ebd76e38e

  • SHA1

    605c01289d5b683a3d5b5eb17ebef72bfc388f91

  • SHA256

    ac07988ba9649741c59d16698f8c33295b3ff7943eeccbafe6f988e3e3c10908

  • SHA512

    a4449aa855a6426106516bf11499902f402ed4589fa7f11e628fec9efbcd6b8a6fcabdfb02d2fe3bf20a41889c734538e77194a011112b4dc06ae94e6b9c066e

  • SSDEEP

    6144:Vn1m9kdbXgb8y3ZetJs0hdMJUXTdU5u/LbquQFBql4yUhNttSMS6EgU0rh:VOesblwtqSdLTdoaNQO6hQX+h

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.siscop.com.co
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    +5s48Ia2&-(t

Targets

    • Target

      orden de compra.xla.xlsx

    • Size

      391KB

    • MD5

      060f999d180fb2c37059815ebd76e38e

    • SHA1

      605c01289d5b683a3d5b5eb17ebef72bfc388f91

    • SHA256

      ac07988ba9649741c59d16698f8c33295b3ff7943eeccbafe6f988e3e3c10908

    • SHA512

      a4449aa855a6426106516bf11499902f402ed4589fa7f11e628fec9efbcd6b8a6fcabdfb02d2fe3bf20a41889c734538e77194a011112b4dc06ae94e6b9c066e

    • SSDEEP

      6144:Vn1m9kdbXgb8y3ZetJs0hdMJUXTdU5u/LbquQFBql4yUhNttSMS6EgU0rh:VOesblwtqSdLTdoaNQO6hQX+h

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Downloads MZ/PE file

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks